asf: Check return value of more avio_seek calls

[ffmpeg] / libavformat / rtpdec_asf.c

diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c
index 58c9068a873f148f0cfa7ca1ce7f3843cf2e19b4..b481c37c8206eaf0e6c9dbc2d0d9f5ef7eb6940b 100644 (file)
--- a/libavformat/rtpdec_asf.c
+++ b/libavformat/rtpdec_asf.c
@@ -107,10 +107,13 @@ int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)
                    "Failed to fix invalid RTSP-MS/ASF min_pktsize\n");
         init_packetizer(&pb, buf, len);
         if (rt->asf_ctx) {
-            av_close_input_stream(rt->asf_ctx);
+            av_close_input_file(rt->asf_ctx);
             rt->asf_ctx = NULL;
         }
-        ret = av_open_input_stream(&rt->asf_ctx, &pb, "", &ff_asf_demuxer, NULL);
+        if (!(rt->asf_ctx = avformat_alloc_context()))
+            return AVERROR(ENOMEM);
+        rt->asf_ctx->pb      = &pb;
+        ret = avformat_open_input(&rt->asf_ctx, "", &ff_asf_demuxer, NULL);
         if (ret < 0)
             return ret;
         av_dict_copy(&s->metadata, rt->asf_ctx->metadata, 0);
@@ -230,8 +233,14 @@ static int asfrtp_parse_packet(AVFormatContext *s, PayloadContext *asf,
 
                 int cur_len = start_off + len_off - off;
                 int prev_len = out_len;
+                void *newmem;
                 out_len += cur_len;
-                asf->buf = av_realloc(asf->buf, out_len);
+                if (FFMIN(cur_len, len - off) < 0)
+                    return -1;
+                newmem = av_realloc(asf->buf, out_len);
+                if (!newmem)
+                    return -1;
+                asf->buf = newmem;
                 memcpy(asf->buf + prev_len, buf + off,
                        FFMIN(cur_len, len - off));
                 avio_skip(pb, cur_len);