Both avio_skip and detect_unknown_subobject use int64_t for the size
parameter.
This fixes a segmentation fault due to infinite recursion.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Alexandra Hájková <alexandra.khirnova@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
uint64_t size = avio_rl64(pb);
int ret;
+ if (size > INT64_MAX)
+ return AVERROR_INVALIDDATA;
+
if (asf->is_header)
asf->unknown_size = size;
asf->is_header = 0;