chunk_size = AV_RL32(&preamble[2]) + RoQ_CHUNK_PREAMBLE_SIZE * 2 +
codebook_size;
+ if (chunk_size > INT_MAX)
+ return AVERROR_INVALIDDATA;
+
/* rewind */
avio_seek(pb, codebook_offset, SEEK_SET);
pkt->pos= avio_tell(pb);
ret = avio_read(pb, pkt->data + RoQ_CHUNK_PREAMBLE_SIZE,
chunk_size);
- if (ret != chunk_size)
+ if (ret != chunk_size) {
+ av_packet_unref(pkt);
ret = AVERROR(EIO);
+ }
packet_read = 1;
break;