avformat/rmdec: Check for overflow in ff_rm_read_mdpr_codecdata()
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 5 Dec 2014 23:18:29 +0000 (00:18 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 17 Jan 2015 23:27:57 +0000 (00:27 +0100)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 03abf55f252945c70f4a79eaf4d609cee4d98710)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/rmdec.c

index 235ff13..3fa0200 100644 (file)
@@ -393,7 +393,11 @@ ff_rm_read_mdpr_codecdata (AVFormatContext *s, AVIOContext *pb,
 skip:
     /* skip codec info */
     size = avio_tell(pb) - codec_pos;
-    avio_skip(pb, codec_data_size - size);
+    if (codec_data_size >= size) {
+        avio_skip(pb, codec_data_size - size);
+    } else {
+        av_log(s, AV_LOG_WARNING, "codec_data_size %u < size %d\n", codec_data_size, size);
+    }
 
     return 0;
 }