Add a few error checks to rm_assemble_video_frame()

Originally committed as revision 16399 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 43fec70..edea8da 100644 (file)
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -498,10 +498,14 @@ static int rm_assemble_video_frame(AVFormatContext *s, ByteIOContext *pb,
         seq = get_byte(pb); len--;
         len2 = get_num(pb, &len);
         pos = get_num(pb, &len);
+        if(len < 1)
+            return -1;
         pic_num = get_byte(pb); len--;
         rm->remaining_len = len;
         break;
     case 1: //whole frame
+        if(len<1)
+            return -1;
         seq = get_byte(pb); len--;
         if(av_new_packet(pkt, len + 9) < 0)
             return AVERROR(EIO);
@@ -515,6 +519,8 @@ static int rm_assemble_video_frame(AVFormatContext *s, ByteIOContext *pb,
         len2 = get_num(pb, &len);
         pos = get_num(pb, &len);
         pic_num = get_byte(pb); len--;
+        if(len < len2)
+            return -1;
         rm->remaining_len = len - len2;
         if(av_new_packet(pkt, len2 + 9) < 0)
             return AVERROR(EIO);