X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fvqf.c;h=449f4061f7552ae64ab408b28156718e8025d4e7;hb=497e7473877243ff8ae02d8701aaf7854b9b57bf;hp=b43725b3c1c28395cbc76b61e6024a1c14b3a63f;hpb=c1e439d7e9abab3cebdc937636393b1656e095d9;p=ffmpeg

diff --git a/libavformat/vqf.c b/libavformat/vqf.c
index b43725b3c1c..449f4061f75 100644
--- a/libavformat/vqf.c
+++ b/libavformat/vqf.c
@@ -132,6 +132,9 @@ static int vqf_read_header(AVFormatContext *s)
 
         switch(chunk_tag){
         case MKTAG('C','O','M','M'):
+            if (len < 12)
+                return AVERROR_INVALIDDATA;
+
             avio_read(s->pb, comm_chunk, 12);
             st->codecpar->channels = AV_RB32(comm_chunk    ) + 1;
             read_bitrate        = AV_RB32(comm_chunk + 4);
@@ -237,8 +240,8 @@ static int vqf_read_packet(AVFormatContext *s, AVPacket *pkt)
     int ret;
     int size = (c->frame_bit_len - c->remaining_bits + 7)>>3;
 
-    if (av_new_packet(pkt, size+2) < 0)
-        return AVERROR(EIO);
+    if ((ret = av_new_packet(pkt, size + 2)) < 0)
+        return ret;
 
     pkt->pos          = avio_tell(s->pb);
     pkt->stream_index = 0;
@@ -249,7 +252,6 @@ static int vqf_read_packet(AVFormatContext *s, AVPacket *pkt)
     ret = avio_read(s->pb, pkt->data+2, size);
 
     if (ret != size) {
-        av_packet_unref(pkt);
         return AVERROR(EIO);
     }