avformat/matroskadec: fix handling of recursive SeekHead elements
authorwm4 <nfxjfg@googlemail.com>
Sat, 6 Dec 2014 15:53:30 +0000 (16:53 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 21 Dec 2014 03:40:35 +0000 (04:40 +0100)
commit437e50b3d65fecd374b56c39c55bc6d340004502
tree3a140b37589f97ce5aa3c4596d7826834163627f
parentb3e98715c0e5d9d8d2fc467b9f2fed9aa6bb0381
avformat/matroskadec: fix handling of recursive SeekHead elements

When matroska_execute_seekhead() is called, it goes through the list of
seekhead entries and attempts to read elements not read yet. When doing
this, the parser can find further SeekHead elements, and will extend the
matroska->seekhead list. This can lead to a (practically) infinite loop
with certain broken files. (Maybe it can happen even with valid files.
The demuxer doesn't seem to check correctly whether an element has
already been read.)

Fix this by ignoring elements that were added to the seekhead field
during executing seekhead entries.

This does not fix the possible situation when multiple SeekHead elements
after the file header (i.e. occur after the "before_pos" file position)
point to the same elements. These elements will probably be parsed
multiple times, likely leading to bugs.

Fixes ticket #4162.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6551acab6877addae815decd02aeca33ba4990c8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/matroskadec.c