ape demuxer: check for EOF in potentially long loops

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

diff --git a/libavformat/ape.c b/libavformat/ape.c
index c4ce6ac..4079947 100644 (file)
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -283,13 +283,13 @@ static int ape_read_header(AVFormatContext * s)
         ape->seektable = av_malloc(ape->seektablelength);
         if (!ape->seektable)
             return AVERROR(ENOMEM);
-        for (i = 0; i < ape->seektablelength / sizeof(uint32_t); i++)
+        for (i = 0; i < ape->seektablelength / sizeof(uint32_t) && !pb->eof_reached; i++)
             ape->seektable[i] = avio_rl32(pb);
         if (ape->fileversion < 3810) {
             ape->bittable = av_malloc(ape->totalframes);
             if (!ape->bittable)
                 return AVERROR(ENOMEM);
-            for (i = 0; i < ape->totalframes; i++)
+            for (i = 0; i < ape->totalframes && !pb->eof_reached; i++)
                 ape->bittable[i] = avio_r8(pb);
         }
     }