Check for symbol count

Originally committed as revision 6910 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/fraps.c b/libavcodec/fraps.c
index aff6566..18d2700 100644 (file)
--- a/libavcodec/fraps.c
+++ b/libavcodec/fraps.c
@@ -140,6 +140,10 @@ static int fraps2_decode_plane(FrapsContext *s, uint8_t *dst, int stride, int w,
         s->nodes[i].sym = i;
         s->nodes[i].count = LE_32(src);
         s->nodes[i].n0 = -2;
+        if(s->nodes[i].count < 0) {
+            av_log(s->avctx, AV_LOG_ERROR, "Symbol count < 0\n");
+            return -1;
+        }
         src += 4;
         sum += s->nodes[i].count;
     }