mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2024-12-23 12:43:46 +02:00
avformat/avidec: Fix infinite loop in avi_read_nikon()
Fixes: 360/test.poc Found-by: 连一汉 <lianyihan@360.cn> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
367577dbe2
commit
e4e4a9cad7
@ -344,14 +344,14 @@ static void avi_metadata_creation_time(AVDictionary **metadata, char *date)
|
||||
|
||||
static void avi_read_nikon(AVFormatContext *s, uint64_t end)
|
||||
{
|
||||
while (avio_tell(s->pb) < end) {
|
||||
while (avio_tell(s->pb) < end && !avio_feof(s->pb)) {
|
||||
uint32_t tag = avio_rl32(s->pb);
|
||||
uint32_t size = avio_rl32(s->pb);
|
||||
switch (tag) {
|
||||
case MKTAG('n', 'c', 't', 'g'): /* Nikon Tags */
|
||||
{
|
||||
uint64_t tag_end = avio_tell(s->pb) + size;
|
||||
while (avio_tell(s->pb) < tag_end) {
|
||||
while (avio_tell(s->pb) < tag_end && !avio_feof(s->pb)) {
|
||||
uint16_t tag = avio_rl16(s->pb);
|
||||
uint16_t size = avio_rl16(s->pb);
|
||||
const char *name = NULL;
|
||||
|
Loading…
Reference in New Issue
Block a user