avio_skip(pb, 4);
ico->nb_images = avio_rl16(pb);
+ if (!ico->nb_images)
+ return AVERROR_INVALIDDATA;
+
ico->images = av_malloc_array(ico->nb_images, sizeof(IcoImage));
if (!ico->images)
return AVERROR(ENOMEM);
int tmp;
if (avio_seek(pb, 6 + i * 16, SEEK_SET) < 0)
- break;
+ goto fail;
st = avformat_new_stream(s, NULL);
if (!st) {
ico->images[i].offset = avio_rl32(pb);
if (avio_seek(pb, ico->images[i].offset, SEEK_SET) < 0)
- break;
+ goto fail;
codec = avio_rl32(pb);
switch (codec) {