nsvdec: Propagate errors
authorAlex Converse <alex.converse@gmail.com>
Fri, 27 Jan 2012 01:23:09 +0000 (17:23 -0800)
committerAlex Converse <alex.converse@gmail.com>
Tue, 6 Mar 2012 23:28:00 +0000 (15:28 -0800)
Related to CVE-2011-3940.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit c898431ca5ef2a997fe9388b650f658fb60783e5)

Conflicts:

libavformat/nsvdec.c

libavformat/nsvdec.c

index 22a1a09..e5aaf33 100644 (file)
@@ -532,11 +532,16 @@ static int nsv_read_header(AVFormatContext *s, AVFormatParameters *ap)
     for (i = 0; i < NSV_MAX_RESYNC_TRIES; i++) {
         if (nsv_resync(s) < 0)
             return -1;
-        if (nsv->state == NSV_FOUND_NSVF)
+        if (nsv->state == NSV_FOUND_NSVF) {
             err = nsv_parse_NSVf_header(s, ap);
+            if (err < 0)
+                return err;
+        }
             /* we need the first NSVs also... */
         if (nsv->state == NSV_FOUND_NSVS) {
             err = nsv_parse_NSVs_header(s, ap);
+            if (err < 0)
+                return err;
             break; /* we just want the first one */
         }
     }