switch(chunk_tag){
case MKTAG('C','O','M','M'):
+ if (len < 12)
+ return AVERROR_INVALIDDATA;
+
avio_read(s->pb, comm_chunk, 12);
st->codecpar->channels = AV_RB32(comm_chunk ) + 1;
read_bitrate = AV_RB32(comm_chunk + 4);
ret = avio_read(s->pb, pkt->data+2, size);
if (ret != size) {
- av_packet_unref(pkt);
return AVERROR(EIO);
}