Merge commit 'b11acd57326db6c2cc1475dd0bea2a06fbc85aa2'

[ffmpeg] / libavformat / nutdec.c

diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c
index 13fb39924d22ea63f0a4d076870c99ee7fc1b9ed..63b0cd2fb95ace9484b899820e07e26732e5d6ce 100644 (file)
--- a/libavformat/nutdec.c
+++ b/libavformat/nutdec.c
@@ -1005,6 +1005,9 @@ static int read_sm_data(AVFormatContext *s, AVIOContext *bc, AVPacket *pkt, int
         AV_WL32(dst+4, skip_end);
     }
 
+    if (avio_tell(bc) >= maxpos)
+        return AVERROR_INVALIDDATA;
+
     return 0;
 }
 
@@ -1277,6 +1280,8 @@ static int read_seek(AVFormatContext *s, int stream_index,
                             next_node[1]->pos, next_node[1]->pos,
                             next_node[0]->ts, next_node[1]->ts,
                             AVSEEK_FLAG_BACKWARD, &ts, nut_read_timestamp);
+        if (pos < 0)
+            return pos;
 
         if (!(flags & AVSEEK_FLAG_BACKWARD)) {
             dummy.pos    = pos + 16;