[SCM] libav/experimental: Return an error when the parsed mpc chunk size is negative, otherwise we might end up in an endless loop where the same chunk is parsed over and over. Fixes a hang near the end for http://samples.mplayerhq.hu/A-codecs/musepack/sv8/sv8-tags.mpc

[siretart at users.alioth.debian.org]

The following commit has been merged in the experimental branch:
commit 5dd76bd741022ee87c8a1945e4ef0d97467f70e3
Author: Reimar Döffinger <Reimar.Doeffinger at gmx.de>
Date:   Wed Sep 30 13:35:13 2009 +0000

    Return an error when the parsed mpc chunk size is negative, otherwise we
    might end up in an endless loop where the same chunk is parsed over and over.
    Fixes a hang near the end for http://samples.mplayerhq.hu/A-codecs/musepack/sv8/sv8-tags.mpc
    
    Originally committed as revision 20099 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavformat/mpc8.c b/libavformat/mpc8.c
index 51817f1..85cbb41 100644
--- a/libavformat/mpc8.c
+++ b/libavformat/mpc8.c
@@ -250,6 +250,8 @@ static int mpc8_read_packet(AVFormatContext *s, AVPacket *pkt)
     while(!url_feof(s->pb)){
         pos = url_ftell(s->pb);
         mpc8_get_chunk_header(s->pb, &tag, &size);
+        if (size < 0)
+            return -1;
         if(tag == TAG_AUDIOPACKET){
             if(av_get_packet(s->pb, pkt, size) < 0)
                 return AVERROR(ENOMEM);

-- 
Libav/FFmpeg packaging