From: Michael Niedermayer <michaelni@gmx.at>
Date: Tue, 30 Dec 2008 20:51:18 +0000 (+0000)
Subject: Add a few error checks to rm_assemble_video_frame()
X-Git-Tag: v0.5~1390
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e45673cb3abc4a99e39b0be07db23d0cda9d1a45;p=platform%2Fupstream%2Flibav.git

Add a few error checks to rm_assemble_video_frame()

Originally committed as revision 16399 to svn://svn.ffmpeg.org/ffmpeg/trunk
---

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 43fec70..edea8da 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -498,10 +498,14 @@ static int rm_assemble_video_frame(AVFormatContext *s, ByteIOContext *pb,
         seq = get_byte(pb); len--;
         len2 = get_num(pb, &len);
         pos = get_num(pb, &len);
+        if(len < 1)
+            return -1;
         pic_num = get_byte(pb); len--;
         rm->remaining_len = len;
         break;
     case 1: //whole frame
+        if(len<1)
+            return -1;
         seq = get_byte(pb); len--;
         if(av_new_packet(pkt, len + 9) < 0)
             return AVERROR(EIO);
@@ -515,6 +519,8 @@ static int rm_assemble_video_frame(AVFormatContext *s, ByteIOContext *pb,
         len2 = get_num(pb, &len);
         pos = get_num(pb, &len);
         pic_num = get_byte(pb); len--;
+        if(len < len2)
+            return -1;
         rm->remaining_len = len - len2;
         if(av_new_packet(pkt, len2 + 9) < 0)
             return AVERROR(EIO);