[FFmpeg-cvslog] r16399 - trunk/libavformat/rmdec.c

[michael]

Author: michael
Date: Tue Dec 30 21:51:18 2008
New Revision: 16399

Log:
Add a few error checks to rm_assemble_video_frame()

Modified:
   trunk/libavformat/rmdec.c

Modified: trunk/libavformat/rmdec.c
==============================================================================
--- trunk/libavformat/rmdec.c	Tue Dec 30 20:49:27 2008	(r16398)
+++ trunk/libavformat/rmdec.c	Tue Dec 30 21:51:18 2008	(r16399)
@@ -498,10 +498,14 @@ static int rm_assemble_video_frame(AVFor
         seq = get_byte(pb); len--;
         len2 = get_num(pb, &len);
         pos = get_num(pb, &len);
+        if(len < 1)
+            return -1;
         pic_num = get_byte(pb); len--;
         rm->remaining_len = len;
         break;
     case 1: //whole frame
+        if(len<1)
+            return -1;
         seq = get_byte(pb); len--;
         if(av_new_packet(pkt, len + 9) < 0)
             return AVERROR(EIO);
@@ -515,6 +519,8 @@ static int rm_assemble_video_frame(AVFor
         len2 = get_num(pb, &len);
         pos = get_num(pb, &len);
         pic_num = get_byte(pb); len--;
+        if(len < len2)
+            return -1;
         rm->remaining_len = len - len2;
         if(av_new_packet(pkt, len2 + 9) < 0)
             return AVERROR(EIO);