if ((ret = detect_unknown_subobject(s, asf->unknown_offset,
asf->unknown_size)) < 0)
return ret;
- } else
+ } else {
+ if (size < 24) {
+ av_log(s, AV_LOG_ERROR, "Too small size %"PRIu64" (< 24).\n", size);
+ return AVERROR_INVALIDDATA;
+ }
avio_skip(pb, size - 24);
+ }
return 0;
}
return 0;
}
-static int asf_read_value(AVFormatContext *s, const uint8_t *name, uint16_t name_len,
+static int asf_read_value(AVFormatContext *s, const uint8_t *name,
uint16_t val_len, int type, AVDictionary **met)
{
int ret;
}
static int asf_set_metadata(AVFormatContext *s, const uint8_t *name,
- uint16_t name_len, int type, AVDictionary **met)
+ int type, AVDictionary **met)
{
AVIOContext *pb = s->pb;
uint64_t value;
if (val_len) {
switch (type) {
case ASF_UNICODE:
- asf_read_value(s, name, name_len, val_len, type, met);
+ asf_read_value(s, name, val_len, type, met);
break;
case ASF_BYTE_ARRAY:
if (!strcmp(name, "WM/Picture")) // handle cover art
else if (!strcmp(name, "ID3")) // handle ID3 tag
get_id3_tag(s, val_len);
else
- asf_read_value(s, name, name_len, val_len, type, met);
+ asf_read_value(s, name, val_len, type, met);
break;
case ASF_GUID:
ff_get_guid(s->pb, &guid);
break;
default:
- if ((ret = asf_set_metadata(s, name, name_len, type, met)) < 0)
+ if ((ret = asf_set_metadata(s, name, type, met)) < 0)
return ret;
break;
}
return 0;
}
-static int asf_read_single_payload(AVFormatContext *s, AVPacket *pkt,
- ASFPacket *asf_pkt)
+static int asf_read_single_payload(AVFormatContext *s, ASFPacket *asf_pkt)
{
ASFContext *asf = s->priv_data;
AVIOContext *pb = s->pb;
if ((ret = asf_read_subpayload(s, pkt, 1)) < 0)
return ret;
} else {
- if ((ret = asf_read_single_payload(s, pkt, asf_pkt)) < 0)
+ if ((ret = asf_read_single_payload(s, asf_pkt)) < 0)
return ret;
}
} else {
while (!pb->eof_reached) {
if (asf->state == PARSE_PACKET_HEADER) {
asf_read_packet_header(s);
+ if (pb->eof_reached)
+ break;
if (!asf->nb_mult_left)
asf->state = READ_SINGLE;
else