[FFmpeg-cvslog] avformat/avidec: Fix infinite loop in avi_read_nikon()

[Michael Niedermayer]

ffmpeg | branch: release/3.0 | Michael Niedermayer <michael at niedermayer.cc> | Fri Sep  2 12:19:29 2016 +0200| [1d90326f95a791db515f69a01a5f6ef867896d15] | committer: Michael Niedermayer

avformat/avidec: Fix infinite loop in avi_read_nikon()

Fixes: 360/test.poc

Found-by: 连一汉 <lianyihan at 360.cn>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit e4e4a9cad7f21593d4bcb1f2404ea0d373c36c43)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1d90326f95a791db515f69a01a5f6ef867896d15
---

 libavformat/avidec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index a6459a0..7209980 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -344,14 +344,14 @@ static void avi_metadata_creation_time(AVDictionary **metadata, char *date)
 
 static void avi_read_nikon(AVFormatContext *s, uint64_t end)
 {
-    while (avio_tell(s->pb) < end) {
+    while (avio_tell(s->pb) < end && !avio_feof(s->pb)) {
         uint32_t tag  = avio_rl32(s->pb);
         uint32_t size = avio_rl32(s->pb);
         switch (tag) {
         case MKTAG('n', 'c', 't', 'g'):  /* Nikon Tags */
         {
             uint64_t tag_end = avio_tell(s->pb) + size;
-            while (avio_tell(s->pb) < tag_end) {
+            while (avio_tell(s->pb) < tag_end && !avio_feof(s->pb)) {
                 uint16_t tag     = avio_rl16(s->pb);
                 uint16_t size    = avio_rl16(s->pb);
                 const char *name = NULL;