swfdec: check lens validity
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 10 Dec 2012 16:20:32 +0000 (17:20 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 20 Jul 2013 23:13:10 +0000 (01:13 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c73685398dee3290dd9f67013f1cd310b7f9fb33)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/swfdec.c

index 6136b54..9a8ef53 100644 (file)
@@ -153,6 +153,10 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
         tag = get_swf_tag(pb, &len);
         if (tag < 0)
             return tag;
+        if (len < 0) {
+            av_log(s, AV_LOG_ERROR, "len %d is invalid\n", len);
+            return AVERROR_INVALIDDATA;
+        }
         if (tag == TAG_VIDEOSTREAM) {
             int ch_id = avio_rl16(pb);
             len -= 2;