X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fmoflex.c;h=0adb5f48646b552c0b76a2ef6ea329705a58839f;hb=bc70684e74a185d7b80c8b80bdedda659cb581b8;hp=a24e12eb8ec555523f08192321156c437f99f1fb;hpb=acd735efaf0ceba95c3f07751182af485af993d2;p=ffmpeg

diff --git a/libavformat/moflex.c b/libavformat/moflex.c
index a24e12eb8ec..0adb5f48646 100644
--- a/libavformat/moflex.c
+++ b/libavformat/moflex.c
@@ -1,5 +1,7 @@
 /*
  * MOFLEX demuxer
+ * Copyright (c) 2015-2016 Florian Nouwt
+ * Copyright (c) 2017 Adib Surani
  * Copyright (c) 2020 Paul B Mahol
  *
  * This file is part of FFmpeg.
@@ -316,6 +318,8 @@ static int moflex_read_packet(AVFormatContext *s, AVPacket *pkt)
             }
 
             pkt_size = pop_int(br, pb, 13) + 1;
+            if (pkt_size > m->size)
+                return AVERROR_INVALIDDATA;
             packet   = s->streams[stream_index]->priv_data;
             if (!packet) {
                 avio_skip(pb, pkt_size);
@@ -365,16 +369,13 @@ static int moflex_read_seek(AVFormatContext *s, int stream_index,
 static int moflex_read_close(AVFormatContext *s)
 {
     for (int i = 0; i < s->nb_streams; i++) {
-        AVPacket *packet = s->streams[i]->priv_data;
-
-        av_packet_free(&packet);
-        s->streams[i]->priv_data = 0;
+        av_packet_free((AVPacket **)&s->streams[i]->priv_data);
     }
 
     return 0;
 }
 
-AVInputFormat ff_moflex_demuxer = {
+const AVInputFormat ff_moflex_demuxer = {
     .name           = "moflex",
     .long_name      = NULL_IF_CONFIG_SMALL("MobiClip MOFLEX"),
     .priv_data_size = sizeof(MOFLEXDemuxContext),