rmenc: limit packet size

[ffmpeg] / libavformat / rmenc.c

diff --git a/libavformat/rmenc.c b/libavformat/rmenc.c
index 6d8fa434671e1f99a10a3954a9545e275cfdd20a..5d8f00193104b0a539de2a4542bccb88a5961a03 100644 (file)
--- a/libavformat/rmenc.c
+++ b/libavformat/rmenc.c
@@ -44,6 +44,10 @@ typedef struct RMMuxContext {
 
 /* in ms */
 #define BUFFER_DURATION 0
+/* the header needs at most 7 + 4 + 12 B */
+#define MAX_HEADER_SIZE (7 + 4 + 12)
+/* UINT16_MAX is the maximal chunk size */
+#define MAX_PACKET_SIZE (UINT16_MAX - MAX_HEADER_SIZE)
 
 
 static void put_str(AVIOContext *s, const char *tag)
@@ -389,6 +393,10 @@ static int rm_write_video(AVFormatContext *s, const uint8_t *buf, int size, int
     /* Well, I spent some time finding the meaning of these bits. I am
        not sure I understood everything, but it works !! */
 #if 1
+    if (size > MAX_PACKET_SIZE) {
+        avpriv_report_missing_feature(s, "Muxing packets larger than 64 kB");
+        return AVERROR(ENOSYS);
+    }
     write_packet_header(s, stream, size + 7 + (size >= 0x4000)*4, key_frame);
     /* bit 7: '1' if final packet of a frame converted in several packets */
     avio_w8(pb, 0x81);