Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
... | ... |
@@ -270,15 +270,16 @@ static void gxf_track_tags(AVIOContext *pb, int *len, struct gxf_stream_info *si |
270 | 270 |
*/ |
271 | 271 |
static void gxf_read_index(AVFormatContext *s, int pkt_len) { |
272 | 272 |
AVIOContext *pb = s->pb; |
273 |
- AVStream *st = s->streams[0]; |
|
273 |
+ AVStream *st; |
|
274 | 274 |
uint32_t fields_per_map = avio_rl32(pb); |
275 | 275 |
uint32_t map_cnt = avio_rl32(pb); |
276 | 276 |
int i; |
277 | 277 |
pkt_len -= 8; |
278 |
- if (s->flags & AVFMT_FLAG_IGNIDX) { |
|
278 |
+ if ((s->flags & AVFMT_FLAG_IGNIDX) || !s->streams) { |
|
279 | 279 |
avio_skip(pb, pkt_len); |
280 | 280 |
return; |
281 | 281 |
} |
282 |
+ st = s->streams[0]; |
|
282 | 283 |
if (map_cnt > 1000) { |
283 | 284 |
av_log(s, AV_LOG_ERROR, "too many index entries %u (%x)\n", map_cnt, map_cnt); |
284 | 285 |
map_cnt = 1000; |