sierravmd: limit packetsize to the amount that could be read.

Fixes huge allocations.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c
index faf97b2d6a0145271a1a8a73545ba8463aaf27c5..f614e51b5c9a5da3bcbffa0a3b5c4a71e889da88 100644 (file)
--- a/libavformat/sierravmd.c
+++ b/libavformat/sierravmd.c
@@ -30,6 +30,7 @@
 #include "libavutil/intreadwrite.h"
 #include "avformat.h"
 #include "internal.h"
+#include "avio_internal.h"
 
 #define VMD_HEADER_SIZE 0x0330
 #define BYTES_PER_FRAME_RECORD 16
@@ -246,6 +247,8 @@ static int vmd_read_packet(AVFormatContext *s,
     /* position the stream (will probably be there already) */
     avio_seek(pb, frame->frame_offset, SEEK_SET);
 
+    if(ffio_limit(pb, frame->frame_size) != frame->frame_size)
+        return AVERROR(EIO);
     if (av_new_packet(pkt, frame->frame_size + BYTES_PER_FRAME_RECORD))
         return AVERROR(ENOMEM);
     pkt->pos= avio_tell(pb);