ape demuxer: check for EOF in potentially long loops
authorAnton Khirnov <anton@khirnov.net>
Sat, 24 Aug 2013 19:30:46 +0000 (21:30 +0200)
committerSean McGovern <gseanmcg@gmail.com>
Mon, 23 Sep 2013 23:48:52 +0000 (19:48 -0400)
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry-picked from commit 488b2984fece7ad0c2596826fee18e74aa904667)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
libavformat/ape.c

index a60626e..7d4cd39 100644 (file)
@@ -276,7 +276,9 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
         ape->seektable = av_malloc(ape->seektablelength);
         if (!ape->seektable)
             return AVERROR(ENOMEM);
-        for (i = 0; i < ape->seektablelength / sizeof(uint32_t); i++)
+        for (i = 0;
+             i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached;
+             i++)
             ape->seektable[i] = avio_rl32(pb);
     }