avsdemux: check for corrupted data
authorLaurent Aimar <fenrir@videolan.org>
Fri, 30 Sep 2011 23:42:31 +0000 (23:42 +0000)
committerJanne Grunau <janne-libav@jannau.net>
Mon, 10 Oct 2011 19:27:04 +0000 (21:27 +0200)
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
libavformat/avs.c

index bf3d4f9..1c699fb 100644 (file)
@@ -163,6 +163,8 @@ static int avs_read_packet(AVFormatContext * s, AVPacket * pkt)
             sub_type = avio_r8(s->pb);
             type = avio_r8(s->pb);
             size = avio_rl16(s->pb);
+            if (size < 4)
+                return AVERROR_INVALIDDATA;
             avs->remaining_frame_size -= size;
 
             switch (type) {