[SCM] libav/experimental: Add a few error checks to rm_assemble_video_frame()

[siretart at users.alioth.debian.org]

The following commit has been merged in the experimental branch:
commit e45673cb3abc4a99e39b0be07db23d0cda9d1a45
Author: Michael Niedermayer <michaelni at gmx.at>
Date:   Tue Dec 30 20:51:18 2008 +0000

    Add a few error checks to rm_assemble_video_frame()
    
    Originally committed as revision 16399 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 43fec70..edea8da 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -498,10 +498,14 @@ static int rm_assemble_video_frame(AVFormatContext *s, ByteIOContext *pb,
         seq = get_byte(pb); len--;
         len2 = get_num(pb, &len);
         pos = get_num(pb, &len);
+        if(len < 1)
+            return -1;
         pic_num = get_byte(pb); len--;
         rm->remaining_len = len;
         break;
     case 1: //whole frame
+        if(len<1)
+            return -1;
         seq = get_byte(pb); len--;
         if(av_new_packet(pkt, len + 9) < 0)
             return AVERROR(EIO);
@@ -515,6 +519,8 @@ static int rm_assemble_video_frame(AVFormatContext *s, ByteIOContext *pb,
         len2 = get_num(pb, &len);
         pos = get_num(pb, &len);
         pic_num = get_byte(pb); len--;
+        if(len < len2)
+            return -1;
         rm->remaining_len = len - len2;
         if(av_new_packet(pkt, len2 + 9) < 0)
             return AVERROR(EIO);

-- 
Libav/FFmpeg packaging