avfilter/formats: Fix heap-buffer overflow when merging channel layouts

[ffmpeg] / libavformat / mlvdec.c

diff --git a/libavformat/mlvdec.c b/libavformat/mlvdec.c
index ded8196af23776c628295d03024a2ca0e00d538a..03aed7102444fae5113c377113d27b72e4071a24 100644 (file)
--- a/libavformat/mlvdec.c
+++ b/libavformat/mlvdec.c
@@ -52,7 +52,7 @@ typedef struct {
     uint64_t pts;
 } MlvContext;
 
-static int probe(AVProbeData *p)
+static int probe(const AVProbeData *p)
 {
     if (AV_RL32(p->buf) == MKTAG('M','L','V','I') &&
         AV_RL32(p->buf + 4) >= 52 &&
@@ -393,10 +393,14 @@ static int read_packet(AVFormatContext *avctx, AVPacket *pkt)
 {
     MlvContext *mlv = avctx->priv_data;
     AVIOContext *pb;
-    AVStream *st = avctx->streams[mlv->stream_index];
+    AVStream *st;
     int index, ret;
     unsigned int size, space;
 
+    if (!avctx->nb_streams)
+        return AVERROR_EOF;
+
+    st = avctx->streams[mlv->stream_index];
     if (mlv->pts >= st->duration)
         return AVERROR_EOF;
 
@@ -462,8 +466,7 @@ static int read_close(AVFormatContext *s)
     MlvContext *mlv = s->priv_data;
     int i;
     for (i = 0; i < 100; i++)
-        if (mlv->pb[i])
-            ff_format_io_close(s, &mlv->pb[i]);
+        ff_format_io_close(s, &mlv->pb[i]);
     return 0;
 }