From 1d90326f95a791db515f69a01a5f6ef867896d15 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 2 Sep 2016 12:19:29 +0200
Subject: [PATCH] avformat/avidec: Fix infinite loop in avi_read_nikon()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes: 360/test.poc
Found-by: 连一汉 <lianyihan@360.cn>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e4e4a9cad7f21593d4bcb1f2404ea0d373c36c43)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/avidec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index a6459a0e05..72099806a6 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -344,14 +344,14 @@ static void avi_metadata_creation_time(AVDictionary **metadata, char *date)
static void avi_read_nikon(AVFormatContext *s, uint64_t end)
{
- while (avio_tell(s->pb) < end) {
+ while (avio_tell(s->pb) < end && !avio_feof(s->pb)) {
uint32_t tag = avio_rl32(s->pb);
uint32_t size = avio_rl32(s->pb);
switch (tag) {
case MKTAG('n', 'c', 't', 'g'): /* Nikon Tags */
{
uint64_t tag_end = avio_tell(s->pb) + size;
- while (avio_tell(s->pb) < tag_end) {
+ while (avio_tell(s->pb) < tag_end && !avio_feof(s->pb)) {
uint16_t tag = avio_rl16(s->pb);
uint16_t size = avio_rl16(s->pb);
const char *name = NULL;