swfdec: check lens validity

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 4 insertions, 0 deletions

diff --git a/libavformat/swfdec.c b/libavformat/swfdec.c
index b8100cb3fe..eb71208060 100644
--- a/libavformat/swfdec.c
+++ b/libavformat/swfdec.c
@@ -155,6 +155,10 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
         tag = get_swf_tag(pb, &len);
         if (tag < 0)
             return tag;
+        if (len < 0) {
+            av_log(s, AV_LOG_ERROR, "len %d is invalid\n", len);
+            return AVERROR_INVALIDDATA;
+        }
         if (tag == TAG_VIDEOSTREAM) {
             int ch_id = avio_rl16(pb);
             len -= 2;