Merge commit '342c43d154e586bc022c86b168fe8d36f69da9d3'

* commit '342c43d154e586bc022c86b168fe8d36f69da9d3':
  omadec: Properly check lengths before incrementing the position

See: f1d6f013b2078140fb701978d720abecde7cd73f
Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavformat/omadec.c
index fd7eb0bf7ff69277895454b60ae92c63cb326117,274112e5af7b42315c36ba2242589717221ad1b0..d0cb6d49a712314779a05345f79f836b7304afd0
--- 1/libavformat/omadec.c
--- 2/libavformat/omadec.c
+++ b/libavformat/omadec.c
@@@ -171,9 -172,13 +171,13 @@@ static int nprobe(AVFormatContext *s, u
      taglen  = AV_RB32(&enc_header[pos + 32]);
      datalen = AV_RB32(&enc_header[pos + 36]) >> 4;
  
-     pos += 44 + taglen;
+     pos += 44;
+     if (size - pos < taglen)
+         return -1;
+ 
+     pos += taglen;
  
 -    if (datalen << 4 > size - pos)
 +    if (pos + (((uint64_t)datalen) << 4) > size)
          return -1;
  
      av_des_init(&av_des, n_val, 192, 1);