Merge commit '24130234cd9dd733116d17b724ea4c8e12ce097a'

* commit '24130234cd9dd733116d17b724ea4c8e12ce097a':
  rtpdec_mpeg4: validate fmtp fields

Merged with fixed log message.

Merged-by: Clément Bœsch <u@pkh.me>

diff --cc libavformat/rtpdec_mpeg4.c
index 068d3785694bf70753358d8a61da9b531dffa0d6,bc50da2a8bfc196ac9c8fc5a9cd4c80f7c1a8222..994ab49251769f8bdddbb9246237f1d18a10483c
--- 1/libavformat/rtpdec_mpeg4.c
--- 2/libavformat/rtpdec_mpeg4.c
+++ b/libavformat/rtpdec_mpeg4.c
@@@ -289,11 -290,22 +289,22 @@@ static int parse_fmtp(AVFormatContext *
          for (i = 0; attr_names[i].str; ++i) {
              if (!av_strcasecmp(attr, attr_names[i].str)) {
                  if (attr_names[i].type == ATTR_NAME_TYPE_INT) {
 -                               "The %s field size is invalid (%d).",
+                     int val = atoi(value);
+                     if (val > 32) {
+                         av_log(s, AV_LOG_ERROR,
++                               "The %s field size is invalid (%d)\n",
+                                attr, val);
+                         return AVERROR_INVALIDDATA;
+                     }
                      *(int *)((char *)data+
-                         attr_names[i].offset) = atoi(value);
-                 } else if (attr_names[i].type == ATTR_NAME_TYPE_STR)
+                         attr_names[i].offset) = val;
+                 } else if (attr_names[i].type == ATTR_NAME_TYPE_STR) {
+                     char *val = av_strdup(value);
+                     if (!val)
+                         return AVERROR(ENOMEM);
                      *(char **)((char *)data+
-                         attr_names[i].offset) = av_strdup(value);
+                         attr_names[i].offset) = val;
+                 }
              }
          }
      }