Merge commit 'c59fec783d6540dd96540b079d753ee4a6ad2e58'

[ffmpeg] / libavformat / rmdec.c

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 4a4665483f99549df24bbdbcf8e40dd6da19389a..1a61b10d447e7c03b2a7ab260dd7cd138a5cf9dd 100644 (file)
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -1357,6 +1357,11 @@ static int ivr_read_packet(AVFormatContext *s, AVPacket *pkt)
                 size = avio_rb32(pb);
                 avio_skip(pb, 4);
 
+                if (size < 1 || size > INT_MAX/4) {
+                    av_log(s, AV_LOG_ERROR, "size %u is invalid\n", size);
+                    return AVERROR_INVALIDDATA;
+                }
+
                 st = s->streams[index];
                 ret = ff_rm_parse_packet(s, pb, st, st->priv_data, size, pkt,
                                          &seq, 0, pts);
@@ -1376,7 +1381,7 @@ static int ivr_read_packet(AVFormatContext *s, AVPacket *pkt)
                     return AVERROR_EOF;
                 }
             } else {
-                av_log(s, AV_LOG_ERROR, "Unsupported opcode=%d at %lX\n", opcode, avio_tell(pb) - 1);
+                av_log(s, AV_LOG_ERROR, "Unsupported opcode=%d at %"PRIX64"\n", opcode, avio_tell(pb) - 1);
                 return AVERROR(EIO);
             }
         }
@@ -1394,5 +1399,6 @@ AVInputFormat ff_ivr_demuxer = {
     .read_probe     = ivr_probe,
     .read_header    = ivr_read_header,
     .read_packet    = ivr_read_packet,
+    .read_close     = rm_read_close,
     .extensions     = "ivr",
 };