avformat/ty: check cur_chunk_pos before using it

Fixes #6831. Signed-off-by: Paul B Mahol <onemda@gmail.com>
7 years ago · f38d0d0c22
parent a38b14a432
commit f38d0d0c22
1 changed files with 2 additions and 0 deletions
--- a/libavformat/ty.c
+++ b/libavformat/ty.c
@ -378,6 +378,8 @@ static void parse_master(AVFormatContext *s)

    ty->cur_chunk_pos = 32;
    for (j = 0; j < ty->seq_table_size; j++) {
+        if (ty->cur_chunk_pos >= CHUNK_SIZE - 8)
+            return;
        ty->seq_table[j].timestamp = AV_RB64(ty->chunk + ty->cur_chunk_pos);
        ty->cur_chunk_pos += 8;
        if (map_size > 8) {