diff options
-rw-r--r-- | libavformat/cafdec.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c index a576dac07e..f166804795 100644 --- a/libavformat/cafdec.c +++ b/libavformat/cafdec.c @@ -225,7 +225,7 @@ static int read_header(AVFormatContext *s) AVStream *st; uint32_t tag = 0; int found_data, ret; - int64_t size; + int64_t size, pos; avio_skip(pb, 8); /* magic, version, file flags */ @@ -254,6 +254,7 @@ static int read_header(AVFormatContext *s) tag = avio_rb32(pb); size = avio_rb64(pb); + pos = avio_tell(pb); if (url_feof(pb)) break; @@ -296,9 +297,14 @@ static int read_header(AVFormatContext *s) case MKBETAG('f','r','e','e'): if (size < 0) return AVERROR_INVALIDDATA; - avio_skip(pb, size); break; } + + if (size > 0) { + if (pos + size < pos) + return AVERROR_INVALIDDATA; + avio_skip(pb, FFMAX(0, pos + size - avio_tell(pb))); + } } if (!found_data) |