X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Frmdec.c;h=1a61b10d447e7c03b2a7ab260dd7cd138a5cf9dd;hb=42f0ed67a34d9c5b9b37d00c2f46dff9d9135da2;hp=4a4665483f99549df24bbdbcf8e40dd6da19389a;hpb=fd6c5285f97f2662f256982127f7a4e8288f14ba;p=ffmpeg

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 4a4665483f9..1a61b10d447 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -1357,6 +1357,11 @@ static int ivr_read_packet(AVFormatContext *s, AVPacket *pkt)
                 size = avio_rb32(pb);
                 avio_skip(pb, 4);
 
+                if (size < 1 || size > INT_MAX/4) {
+                    av_log(s, AV_LOG_ERROR, "size %u is invalid\n", size);
+                    return AVERROR_INVALIDDATA;
+                }
+
                 st = s->streams[index];
                 ret = ff_rm_parse_packet(s, pb, st, st->priv_data, size, pkt,
                                          &seq, 0, pts);
@@ -1376,7 +1381,7 @@ static int ivr_read_packet(AVFormatContext *s, AVPacket *pkt)
                     return AVERROR_EOF;
                 }
             } else {
-                av_log(s, AV_LOG_ERROR, "Unsupported opcode=%d at %lX\n", opcode, avio_tell(pb) - 1);
+                av_log(s, AV_LOG_ERROR, "Unsupported opcode=%d at %"PRIX64"\n", opcode, avio_tell(pb) - 1);
                 return AVERROR(EIO);
             }
         }
@@ -1394,5 +1399,6 @@ AVInputFormat ff_ivr_demuxer = {
     .read_probe     = ivr_probe,
     .read_header    = ivr_read_header,
     .read_packet    = ivr_read_packet,
+    .read_close     = rm_read_close,
     .extensions     = "ivr",
 };