[FFmpeg-cvslog] asfdec: check avio_skip in asf_read_simple_index

[Andreas Cadhalpun]

ffmpeg | branch: master | Andreas Cadhalpun <andreas.cadhalpun at googlemail.com> | Thu Jan  7 10:22:00 2016 +0100| [e4d1621c6e51c623061676439a55dfab89d330f6] | committer: Luca Barbato

asfdec: check avio_skip in asf_read_simple_index

The loop can be very long, even though the file is very short.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
Signed-off-by: Alexandra Hájková <alexandra at khirnov.net>
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e4d1621c6e51c623061676439a55dfab89d330f6
---

 libavformat/asfdec.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
index 460df2a..aef61bb 100644
--- a/libavformat/asfdec.c
+++ b/libavformat/asfdec.c
@@ -970,7 +970,7 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g)
     uint64_t interval; // index entry time interval in 100 ns units, usually it's 1s
     uint32_t pkt_num, nb_entries;
     int32_t prev_pkt_num = -1;
-    int i;
+    int i, ret;
     uint64_t size = avio_rl64(pb);
 
     // simple index objects should be ordered by stream number, this loop tries to find
@@ -992,7 +992,11 @@ static int asf_read_simple_index(AVFormatContext *s, const GUIDParseTable *g)
     nb_entries = avio_rl32(pb);
     for (i = 0; i < nb_entries; i++) {
         pkt_num = avio_rl32(pb);
-        avio_skip(pb, 2);
+        ret = avio_skip(pb, 2);
+        if (ret < 0) {
+            av_log(s, AV_LOG_ERROR, "Skipping failed in asf_read_simple_index.\n");
+            return ret;
+        }
         if (prev_pkt_num != pkt_num) {
             av_add_index_entry(st, asf->first_packet_offset + asf->packet_size *
                                pkt_num, av_rescale(interval, i, 10000),