X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fparser.c;h=a63f532c48427f3510c5ea2cc7c563c6e5b99259;hb=36c582f515a7da4c5dda4890fcf588164f91255f;hp=0a994a3f30be699d7dfa6e6756f701caeaeb839c;hpb=fda424b300c1a0b991296aa585691609d01196bd;p=ffmpeg

diff --git a/libavcodec/parser.c b/libavcodec/parser.c
index 0a994a3f30b..a63f532c484 100644
--- a/libavcodec/parser.c
+++ b/libavcodec/parser.c
@@ -245,6 +245,9 @@ int ff_combine_frame(ParseContext *pc, int next,
     for (; pc->overread > 0; pc->overread--)
         pc->buffer[pc->index++] = pc->buffer[pc->overread_index++];
 
+    if (next > *buf_size)
+        return AVERROR(EINVAL);
+
     /* flush remaining if EOF */
     if (!*buf_size && next == END_NOT_FOUND)
         next = 0;
@@ -292,6 +295,10 @@ int ff_combine_frame(ParseContext *pc, int next,
         *buf      = pc->buffer;
     }
 
+    if (next < -8) {
+        pc->overread += -8 - next;
+        next = -8;
+    }
     /* store overread bytes */
     for (; next < 0; next++) {
         pc->state   = pc->state   << 8 | pc->buffer[pc->last_index + next];