mov: abort on EOF in ff_mov_read_chan

[ffmpeg] / libavformat / mov_chan.c

diff --git a/libavformat/mov_chan.c b/libavformat/mov_chan.c
index 2c549204270461bc00f71d806a33f0e28dd7dd00..94b93cf39c78be9824bc2826e12cba7f7381b129 100644 (file)
--- a/libavformat/mov_chan.c
+++ b/libavformat/mov_chan.c
@@ -565,6 +565,11 @@ int ff_mov_read_chan(AVFormatContext *s, AVIOContext *pb, AVStream *st,
     label_mask = 0;
     for (i = 0; i < num_descr; i++) {
         uint32_t label;
+        if (pb->eof_reached) {
+            av_log(s, AV_LOG_ERROR,
+                   "reached EOF while reading channel layout\n");
+            return AVERROR_INVALIDDATA;
+        }
         label     = avio_rb32(pb);          // mChannelLabel
         avio_rb32(pb);                      // mChannelFlags
         avio_rl32(pb);                      // mCoordinates[0]