matroskadec: fix integer overflow

patch from reimar

Originally committed as revision 24803 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 60f03ce362e85e8e0a2ccf3abb12610b962a21ab..ab5e1d13cfba6a828efdcb7b39d6d4af4529334c 100644 (file)
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -901,6 +901,9 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size,
     int result = 0;
     int olen;
 
+    if (pkt_size >= 10000000)
+        return -1;
+
     switch (encodings[0].compression.algo) {
     case MATROSKA_TRACK_ENCODING_COMP_HEADERSTRIP:
         return encodings[0].compression.settings.size;