diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2008-12-30 20:51:18 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2008-12-30 20:51:18 +0000 |
| commit | e45673cb3abc4a99e39b0be07db23d0cda9d1a45 (patch) | |
| tree | 65d5623a919c138b04efa606c37cbdd6b5faba2c /libavformat/rmdec.c | |
| parent | 51d6852f43774165beefee96a9e875db5e3a8189 (diff) | |
| download | ffmpeg-e45673cb3abc4a99e39b0be07db23d0cda9d1a45.tar.gz | |
Add a few error checks to rm_assemble_video_frame()
Originally committed as revision 16399 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavformat/rmdec.c')
| -rw-r--r-- | libavformat/rmdec.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index 43fec701a7..edea8dad2e 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -498,10 +498,14 @@ static int rm_assemble_video_frame(AVFormatContext *s, ByteIOContext *pb, seq = get_byte(pb); len--; len2 = get_num(pb, &len); pos = get_num(pb, &len); + if(len < 1) + return -1; pic_num = get_byte(pb); len--; rm->remaining_len = len; break; case 1: //whole frame + if(len<1) + return -1; seq = get_byte(pb); len--; if(av_new_packet(pkt, len + 9) < 0) return AVERROR(EIO); @@ -515,6 +519,8 @@ static int rm_assemble_video_frame(AVFormatContext *s, ByteIOContext *pb, len2 = get_num(pb, &len); pos = get_num(pb, &len); pic_num = get_byte(pb); len--; + if(len < len2) + return -1; rm->remaining_len = len - len2; if(av_new_packet(pkt, len2 + 9) < 0) return AVERROR(EIO); |