Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavformat/vividas.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/libavformat/vividas.c b/libavformat/vividas.c index e4255fd5cc..b804260b5d 100644 --- a/libavformat/vividas.c +++ b/libavformat/vividas.c @@ -52,6 +52,7 @@ typedef struct VIV_AudioSubpacket { typedef struct VividasDemuxContext { int n_sb_blocks; VIV_SB_block *sb_blocks; + int num_audio; uint32_t sb_key; int64_t sb_offset; @@ -280,7 +281,7 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t * int i,j; int64_t off; int val_1; - int num_video, num_audio; + int num_video; AVIOContext *pb; pb = avio_alloc_context(buf, size, 0, NULL, NULL, NULL, NULL); @@ -340,13 +341,13 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t * off = avio_tell(pb); off += ffio_read_varlen(pb); // val_10 avio_r8(pb); // '4' - num_audio = avio_r8(pb); + viv->num_audio = avio_r8(pb); avio_seek(pb, off, SEEK_SET); - if (num_audio != 1) - av_log(s, AV_LOG_WARNING, "number of audio tracks %d is not 1\n", num_audio); + if (viv->num_audio != 1) + av_log(s, AV_LOG_WARNING, "number of audio tracks %d is not 1\n", viv->num_audio); - for(i=0;i<num_audio;i++) { + for(i=0;i<viv->num_audio;i++) { int q; AVStream *st = avformat_new_stream(s, NULL); @@ -676,6 +677,9 @@ static int viv_read_packet(AVFormatContext *s, if (viv->sb_entries[viv->current_sb_entry].flag == 0) { uint64_t v_size = ffio_read_varlen(pb); + if (!viv->num_audio) + return AVERROR_INVALIDDATA; + ffio_read_varlen(pb); if (v_size > INT_MAX) return AVERROR_INVALIDDATA; -- 2.23.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".