Merge commit 'c59fec783d6540dd96540b079d753ee4a6ad2e58'

[ffmpeg] / libavformat / rmdec.c

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 4e46a3d6e6c505cefa3e3e73b02864f526fcdb54..1a61b10d447e7c03b2a7ab260dd7cd138a5cf9dd 100644 (file)
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -1357,6 +1357,11 @@ static int ivr_read_packet(AVFormatContext *s, AVPacket *pkt)
                 size = avio_rb32(pb);
                 avio_skip(pb, 4);
 
+                if (size < 1 || size > INT_MAX/4) {
+                    av_log(s, AV_LOG_ERROR, "size %u is invalid\n", size);
+                    return AVERROR_INVALIDDATA;
+                }
+
                 st = s->streams[index];
                 ret = ff_rm_parse_packet(s, pb, st, st->priv_data, size, pkt,
                                          &seq, 0, pts);
@@ -1394,5 +1399,6 @@ AVInputFormat ff_ivr_demuxer = {
     .read_probe     = ivr_probe,
     .read_header    = ivr_read_header,
     .read_packet    = ivr_read_packet,
+    .read_close     = rm_read_close,
     .extensions     = "ivr",
 };