asfdec: avoid crash in the case when chunk_len is 0 or pkt_len is 0
authorAlexandra Hájková <alexandra.khirnova@gmail.com>
Tue, 21 Jul 2015 08:45:01 +0000 (10:45 +0200)
committerAnton Khirnov <anton@khirnov.net>
Wed, 22 Jul 2015 10:11:46 +0000 (12:11 +0200)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
libavformat/asfdec.c

index 6a71be9ab2da25693dca393184b9d11ccc11aa95..6dc34d9735e0665b0dc844f8f5316456ade2f749 100644 (file)
@@ -776,6 +776,8 @@ static int asf_read_stream_properties(AVFormatContext *s, const GUIDParseTable *
                 asf_st->span              = span;
                 asf_st->virtual_pkt_len   = avio_rl16(pb);
                 asf_st->virtual_chunk_len = avio_rl16(pb);
+                if (!asf_st->virtual_chunk_len || !asf_st->virtual_pkt_len)
+                    return AVERROR_INVALIDDATA;
                 avio_skip(pb, err_data_len - 5);
             } else
                 avio_skip(pb, err_data_len - 1);