From a6cba062051f345e8ebfdff34aba071ed73d923f Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 10 Mar 2018 01:40:36 +0100
Subject: avformat/img2dec: fix infinite loop

Fixes: kira-poc

Found-by: Kira <kira_cxy@foxmail.com>
Change suggested by Kira
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/img2dec.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'libavformat/img2dec.c')

diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
index 62db0d9..f3f52c8 100644
--- a/libavformat/img2dec.c
+++ b/libavformat/img2dec.c
@@ -878,10 +878,14 @@ static int svg_probe(AVProbeData *p)
 {
     const uint8_t *b = p->buf;
     const uint8_t *end = p->buf + p->buf_size;
+
     if (memcmp(p->buf, "<?xml", 5))
         return 0;
     while (b < end) {
-        b += ff_subtitles_next_line(b);
+        int inc = ff_subtitles_next_line(b);
+        if (!inc)
+            break;
+        b += inc;
         if (b >= end - 4)
             return 0;
         if (!memcmp(b, "<svg", 4))
-- 
cgit v1.1