These loops can take a lot of time if count is very large.
Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit bb23a15df507440deb0dcf25099d321d0f73dc28)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
... | ... |
@@ -492,7 +492,7 @@ static int decode_info_header(NUTContext *nut) |
492 | 492 |
AVIOContext *bc = s->pb; |
493 | 493 |
uint64_t tmp, chapter_start, chapter_len; |
494 | 494 |
unsigned int stream_id_plus1, count; |
495 |
- int chapter_id, i; |
|
495 |
+ int chapter_id, i, ret; |
|
496 | 496 |
int64_t value, end; |
497 | 497 |
char name[256], str_value[1024], type_str[256]; |
498 | 498 |
const char *type; |
... | ... |
@@ -534,7 +534,11 @@ static int decode_info_header(NUTContext *nut) |
534 | 534 |
} |
535 | 535 |
|
536 | 536 |
for (i = 0; i < count; i++) { |
537 |
- get_str(bc, name, sizeof(name)); |
|
537 |
+ ret = get_str(bc, name, sizeof(name)); |
|
538 |
+ if (ret < 0) { |
|
539 |
+ av_log(s, AV_LOG_ERROR, "get_str failed while decoding info header\n"); |
|
540 |
+ return ret; |
|
541 |
+ } |
|
538 | 542 |
value = get_s(bc); |
539 | 543 |
str_value[0] = 0; |
540 | 544 |
|
... | ... |
@@ -845,14 +849,18 @@ static int read_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int |
845 | 845 |
int sample_rate = 0; |
846 | 846 |
int width = 0; |
847 | 847 |
int height = 0; |
848 |
- int i; |
|
848 |
+ int i, ret; |
|
849 | 849 |
|
850 | 850 |
for (i=0; i<count; i++) { |
851 | 851 |
uint8_t name[256], str_value[256], type_str[256]; |
852 | 852 |
int value; |
853 | 853 |
if (avio_tell(bc) >= maxpos) |
854 | 854 |
return AVERROR_INVALIDDATA; |
855 |
- get_str(bc, name, sizeof(name)); |
|
855 |
+ ret = get_str(bc, name, sizeof(name)); |
|
856 |
+ if (ret < 0) { |
|
857 |
+ av_log(s, AV_LOG_ERROR, "get_str failed while reading sm data\n"); |
|
858 |
+ return ret; |
|
859 |
+ } |
|
856 | 860 |
value = get_s(bc); |
857 | 861 |
|
858 | 862 |
if (value == -1) { |