avformat/pva: Check for EOF before retrying in read_part_of_packet()

Fixes: Infinite loop
Fixes: pva-4b1835dbc2027bf3c567005dcc78e85199240d06
Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2018-1999012.patch

diff --git a/libavformat/pva.c b/libavformat/pva.c
index 3abfc18508bbf3d485ff46b7a8dd00c297cc4d35..ea52892790427bd76eb363388eb81e3ad17ceed7 100644 (file)
--- a/libavformat/pva.c
+++ b/libavformat/pva.c
@@ -120,6 +120,10 @@ recover:
             pes_flags              = avio_rb16(pb);
             pes_header_data_length = avio_r8(pb);
 
+            if (avio_feof(pb)) {
+                return AVERROR_EOF;
+            }
+
             if (pes_signal != 1) {
                 pva_log(s, AV_LOG_WARNING, "expected signaled PES packet, "
                                           "trying to recover\n");