Revision e45673cb libavformat/rmdec.c

View differences:

libavformat/rmdec.c
498 498
        seq = get_byte(pb); len--;
499 499
        len2 = get_num(pb, &len);
500 500
        pos = get_num(pb, &len);
501
        if(len < 1)
502
            return -1;
501 503
        pic_num = get_byte(pb); len--;
502 504
        rm->remaining_len = len;
503 505
        break;
504 506
    case 1: //whole frame
507
        if(len<1)
508
            return -1;
505 509
        seq = get_byte(pb); len--;
506 510
        if(av_new_packet(pkt, len + 9) < 0)
507 511
            return AVERROR(EIO);
......
515 519
        len2 = get_num(pb, &len);
516 520
        pos = get_num(pb, &len);
517 521
        pic_num = get_byte(pb); len--;
522
        if(len < len2)
523
            return -1;
518 524
        rm->remaining_len = len - len2;
519 525
        if(av_new_packet(pkt, len2 + 9) < 0)
520 526
            return AVERROR(EIO);

Also available in: Unified diff