[FFmpeg-cvslog] check std tag size before reading.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sat Dec  1 00:29:39 2012 +0100| [b90e795f737c5efb9f65869b304e87a0985b046d] | committer: Michael Niedermayer

check std tag size before reading.

Fixes out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b90e795f737c5efb9f65869b304e87a0985b046d
---

 libavformat/4xm.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index 0a003d4..1e142f5 100644
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -134,6 +134,10 @@ static int fourxm_read_header(AVFormatContext *s)
         }
 
         if (fourcc_tag == std__TAG) {
+            if (header_size < i + 16) {
+                av_log(s, AV_LOG_ERROR, "std TAG truncated\n");
+                return AVERROR_INVALIDDATA;
+            }
             fourxm->fps = av_int2float(AV_RL32(&header[i + 12]));
         } else if (fourcc_tag == vtrk_TAG) {
             /* check that there is enough data */