diff options
Diffstat (limited to 'chromium/third_party/ffmpeg/libavformat/swfdec.c')
| -rw-r--r-- | chromium/third_party/ffmpeg/libavformat/swfdec.c | 20 |
1 files changed, 17 insertions, 3 deletions
diff --git a/chromium/third_party/ffmpeg/libavformat/swfdec.c b/chromium/third_party/ffmpeg/libavformat/swfdec.c index e6ceec818af..c95b18ec6cb 100644 --- a/chromium/third_party/ffmpeg/libavformat/swfdec.c +++ b/chromium/third_party/ffmpeg/libavformat/swfdec.c @@ -446,16 +446,30 @@ bitmap_end_skip: goto skip; if ((res = av_new_packet(pkt, len)) < 0) return res; - avio_read(pb, pkt->data, 4); + if (avio_read(pb, pkt->data, 4) != 4) { + av_free_packet(pkt); + return AVERROR_INVALIDDATA; + } if (AV_RB32(pkt->data) == 0xffd8ffd9 || AV_RB32(pkt->data) == 0xffd9ffd8) { /* old SWF files containing SOI/EOI as data start */ /* files created by swink have reversed tag */ pkt->size -= 4; - avio_read(pb, pkt->data, pkt->size); + memset(pkt->data+pkt->size, 0, 4); + res = avio_read(pb, pkt->data, pkt->size); } else { - avio_read(pb, pkt->data + 4, pkt->size - 4); + res = avio_read(pb, pkt->data + 4, pkt->size - 4); + if (res >= 0) + res += 4; + } + if (res != pkt->size) { + if (res < 0) { + av_free_packet(pkt); + return res; + } + av_shrink_packet(pkt, res); } + pkt->pos = pos; pkt->stream_index = st->index; return pkt->size; |