}
pkt_len = AV_RB16(data->split_buf + data->split_pos);
data->split_pos += 2;
- if (data->split_pos + pkt_len > data->split_buf_len) {
+ if (pkt_len > data->split_buf_len - data->split_pos) {
av_log(ctx, AV_LOG_ERROR, "Not enough data to return\n");
return AVERROR_INVALIDDATA;
}
return data->split_pkts > 0;
}
- if (len < 6) {
+ if (len < 6 || len > INT_MAX/2) {
av_log(ctx, AV_LOG_ERROR, "Invalid %d byte packet\n", len);
return AVERROR_INVALIDDATA;
}