Revision 4c71d727

View differences:

libavformat/asf.c
703 703
        asf->packet_size_left -= asf->packet_frag_size;
704 704
        if (asf->packet_size_left < 0)
705 705
            continue;
706

  
707
        if(   asf->packet_frag_offset >= asf_st->pkt.size
708
           || asf->packet_frag_size > asf_st->pkt.size - asf->packet_frag_offset){
709
            av_log(s, AV_LOG_ERROR, "packet fragment position invalid %u,%u not in %u\n",
710
                asf->packet_frag_offset, asf->packet_frag_size, asf_st->pkt.size);
711
            continue;
712
        }
713

  
706 714
        get_buffer(pb, asf_st->pkt.data + asf->packet_frag_offset,
707 715
                   asf->packet_frag_size);
708 716
        asf_st->frag_offset += asf->packet_frag_size;
libavformat/asf.h
106 106
    int packet_replic_size;
107 107
    int packet_key_frame;
108 108
    int packet_padsize;
109
    int packet_frag_offset;
110
    int packet_frag_size;
109
    unsigned int packet_frag_offset;
110
    unsigned int packet_frag_size;
111 111
    int packet_frag_timestamp;
112 112
    int packet_multi_size;
113 113
    int packet_obj_size;

Also available in: Unified diff