memcpy(oldpal, pal, 768);
size = avio_r8(s->pb);
size = size * 4 - 1;
+ if(size + 1 > frame_size)
+ return AVERROR_INVALIDDATA;
frame_size -= size;
frame_size--;
sz = 0;
/* if audio chunks are present, put them to stack and retrieve later */
for(i = 0; i < 7; i++) {
if(flags & 1) {
- int size;
+ unsigned int size;
uint8_t *tmpbuf;
size = avio_rl32(s->pb) - 4;
+ if(size + 4L > frame_size)
+ return AVERROR_INVALIDDATA;
frame_size -= size;
frame_size -= 4;
smk->curstream++;