diff --git a/libavformat/asf.c b/libavformat/asf.c index 6c4bb35d5d..dd13458e01 100644 --- a/libavformat/asf.c +++ b/libavformat/asf.c @@ -502,11 +502,11 @@ static int asf_get_packet(AVFormatContext *s) //the following checks prevent overflows and infinite loops if(packet_length >= (1U<<29)){ av_log(s, AV_LOG_ERROR, "invalid packet_length %d at:%"PRId64"\n", packet_length, url_ftell(pb)); - return 0; // FIXME this should be -1 + return -1; } if(padsize >= (1U<<29)){ av_log(s, AV_LOG_ERROR, "invalid padsize %d at:%"PRId64"\n", padsize, url_ftell(pb)); - return 0; // FIXME this should be -1 + return -1; } asf->packet_timestamp = get_le32(pb); @@ -598,6 +598,8 @@ static int asf_read_packet(AVFormatContext *s, AVPacket *pkt) ByteIOContext *pb = &s->pb; //static int pc = 0; for (;;) { + if(url_feof(pb)) + return AVERROR_IO; if (asf->packet_size_left < FRAME_HEADER_SIZE || asf->packet_segments < 1) { //asf->packet_size_left <= asf->packet_padsize) { @@ -619,8 +621,8 @@ static int asf_read_packet(AVFormatContext *s, AVPacket *pkt) return AVERROR_IO; /* Do not exceed the size of the data object */ ret = asf_get_packet(s); //printf("READ ASF PACKET %d r:%d c:%d\n", ret, asf->packet_size_left, pc++); - if (ret < 0 || url_feof(pb)) - return AVERROR_IO; + if (ret < 0) + assert(asf->packet_size_left < FRAME_HEADER_SIZE || asf->packet_segments < 1); asf->packet_time_start = 0; continue; }