diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 5a9acd5ba7..bc73bfed11 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -1258,13 +1258,23 @@ static int ebml_parse_elem(MatroskaDemuxContext *matroska, case EBML_STOP: return 1; default: - if (ffio_limit(pb, length) != length) { - // ffio_limit emits its own error message, - // so we don't have to. - return AVERROR(EIO); - } - res = avio_skip(pb, length); - res = res < 0 ? res : 0; + if (length) { + if (ffio_limit(pb, length) != length) { + // ffio_limit emits its own error message, + // so we don't have to. + return AVERROR(EIO); + } + if ((res = avio_skip(pb, length - 1)) >= 0) { + // avio_skip might take us past EOF. We check for this + // by skipping only length - 1 bytes, reading a byte and + // checking the error flags. This is done in order to check + // that the element has been properly skipped even when + // no filesize (that ffio_limit relies on) is available. + avio_r8(pb); + res = NEEDS_CHECKING; + } + } else + res = 0; } if (res) { if (res == NEEDS_CHECKING) {