[FFmpeg-cvslog] avformat/mpc8: check avio_read() return in mpc8_parse_seektable()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Wed Dec 25 23:55:06 2013 +0100| [26ce266e3df8d50b0e6b3b402f2436903424c30c] | committer: Michael Niedermayer

avformat/mpc8: check avio_read() return in mpc8_parse_seektable()

no sample / testcase known

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=26ce266e3df8d50b0e6b3b402f2436903424c30c
---

 libavformat/mpc8.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/libavformat/mpc8.c b/libavformat/mpc8.c
index 502eaff..b32bc9c 100644
--- a/libavformat/mpc8.c
+++ b/libavformat/mpc8.c
@@ -136,7 +136,7 @@ static void mpc8_parse_seektable(AVFormatContext *s, int64_t off)
     int tag;
     int64_t size, pos, ppos[2];
     uint8_t *buf;
-    int i, t, seekd;
+    int i, t, seekd, ret;
     GetBitContext gb;
 
     if (s->nb_streams == 0) {
@@ -156,7 +156,12 @@ static void mpc8_parse_seektable(AVFormatContext *s, int64_t off)
     }
     if(!(buf = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE)))
         return;
-    avio_read(s->pb, buf, size);
+    ret = avio_read(s->pb, buf, size);
+    if (ret != size) {
+        av_log(s, AV_LOG_ERROR, "seek table truncated\n");
+        av_free(buf);
+        return;
+    }
     memset(buf+size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
 
     init_get_bits(&gb, buf, size * 8);