Originally committed as revision 16399 to svn://svn.ffmpeg.org/ffmpeg/trunk
seq = get_byte(pb); len--;
len2 = get_num(pb, &len);
pos = get_num(pb, &len);
+ if(len < 1)
+ return -1;
pic_num = get_byte(pb); len--;
rm->remaining_len = len;
break;
case 1: //whole frame
+ if(len<1)
+ return -1;
seq = get_byte(pb); len--;
if(av_new_packet(pkt, len + 9) < 0)
return AVERROR(EIO);
len2 = get_num(pb, &len);
pos = get_num(pb, &len);
pic_num = get_byte(pb); len--;
+ if(len < len2)
+ return -1;
rm->remaining_len = len - len2;
if(av_new_packet(pkt, len2 + 9) < 0)
return AVERROR(EIO);