oggspeexparse: fix array overread

[ffmpeg] / libavformat / 4xm.c

diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index 0a003d4b8e3e6eb197bd9963f9d7bc9b3d2e307d..1e142f550f2b2ec166c3947c9bec5b1aaf1c8bc1 100644 (file)
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -134,6 +134,10 @@ static int fourxm_read_header(AVFormatContext *s)
         }
 
         if (fourcc_tag == std__TAG) {
+            if (header_size < i + 16) {
+                av_log(s, AV_LOG_ERROR, "std TAG truncated\n");
+                return AVERROR_INVALIDDATA;
+            }
             fourxm->fps = av_int2float(AV_RL32(&header[i + 12]));
         } else if (fourcc_tag == vtrk_TAG) {
             /* check that there is enough data */