Merge remote-tracking branch 'qatar/master'

[ffmpeg] / libavformat / siff.c

diff --git a/libavformat/siff.c b/libavformat/siff.c
index a8d63ee1c0424bb82c00aeb8a684f92d0d78d30f..1a3f0a4e478314e1ac23dd19cf530ca40eabfa1a 100644 (file)
--- a/libavformat/siff.c
+++ b/libavformat/siff.c
@@ -22,6 +22,7 @@
 #include "libavutil/intreadwrite.h"
 #include "avformat.h"
 #include "internal.h"
+#include "avio_internal.h"
 
 enum SIFFTags{
     TAG_SIFF = MKTAG('S', 'I', 'F', 'F'),
@@ -201,13 +202,16 @@ static int siff_read_packet(AVFormatContext *s, AVPacket *pkt)
         }
 
         if (!c->curstrm){
-            size = c->pktsize - c->sndsize;
-            if (av_new_packet(pkt, size) < 0)
+            size = c->pktsize - c->sndsize - c->gmcsize - 2;
+            size = ffio_limit(s->pb, size);
+            if(size < 0 || c->pktsize < c->sndsize)
+                return AVERROR_INVALIDDATA;
+            if (av_new_packet(pkt, size + c->gmcsize + 2) < 0)
                 return AVERROR(ENOMEM);
             AV_WL16(pkt->data, c->flags);
             if (c->gmcsize)
                 memcpy(pkt->data + 2, c->gmc, c->gmcsize);
-            avio_read(s->pb, pkt->data + 2 + c->gmcsize, size - c->gmcsize - 2);
+            avio_read(s->pb, pkt->data + 2 + c->gmcsize, size);
             pkt->stream_index = 0;
             c->curstrm = -1;
         }else{