X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Frmdec.c;h=1a61b10d447e7c03b2a7ab260dd7cd138a5cf9dd;hb=42f0ed67a34d9c5b9b37d00c2f46dff9d9135da2;hp=4e46a3d6e6c505cefa3e3e73b02864f526fcdb54;hpb=0c7ade547ad8aeaee0e1afd5b6730087b6c97da2;p=ffmpeg

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 4e46a3d6e6c..1a61b10d447 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -1357,6 +1357,11 @@ static int ivr_read_packet(AVFormatContext *s, AVPacket *pkt)
                 size = avio_rb32(pb);
                 avio_skip(pb, 4);
 
+                if (size < 1 || size > INT_MAX/4) {
+                    av_log(s, AV_LOG_ERROR, "size %u is invalid\n", size);
+                    return AVERROR_INVALIDDATA;
+                }
+
                 st = s->streams[index];
                 ret = ff_rm_parse_packet(s, pb, st, st->priv_data, size, pkt,
                                          &seq, 0, pts);
@@ -1394,5 +1399,6 @@ AVInputFormat ff_ivr_demuxer = {
     .read_probe     = ivr_probe,
     .read_header    = ivr_read_header,
     .read_packet    = ivr_read_packet,
+    .read_close     = rm_read_close,
     .extensions     = "ivr",
 };