diff options
| -rw-r--r-- | libavformat/rmdec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index 3b476ff..ee1e0ff 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -25,6 +25,7 @@ #include "libavutil/intreadwrite.h" #include "libavutil/dict.h" #include "avformat.h" +#include "avio_internal.h" #include "internal.h" #include "rmsipr.h" #include "rm.h" @@ -696,6 +697,10 @@ static int rm_assemble_video_frame(AVFormatContext *s, AVIOContext *pb, *pseq = seq; if((seq & 0x7F) == 1 || vst->curpic_num != pic_num){ + if (len2 > ffio_limit(pb, len2)) { + av_log(s, AV_LOG_ERROR, "Impossibly sized packet\n"); + return AVERROR_INVALIDDATA; + } vst->slices = ((hdr & 0x3F) << 1) + 1; vst->videobufsize = len2 + 8*vst->slices + 1; av_free_packet(&vst->pkt); //FIXME this should be output. |
