Check for invalid packet size in the smacker demuxer.
authorLaurent Aimar <fenrir@videolan.org>
Mon, 12 Sep 2011 18:50:13 +0000 (20:50 +0200)
committerReinhard Tartler <siretart@tauware.de>
Sat, 24 Dec 2011 11:20:33 +0000 (12:20 +0100)
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e055932f5636a82275837968eea9c8fcb5bca474)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
libavformat/smacker.c

index 056e9dc..a916a7b 100644 (file)
@@ -306,6 +306,8 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
             }
             flags >>= 1;
         }
+        if (frame_size < 0)
+            return AVERROR_INVALIDDATA;
         if (av_new_packet(pkt, frame_size + 768))
             return AVERROR(ENOMEM);
         if(smk->frm_size[smk->cur_frame] & 1)