[FFmpeg-cvslog] avformat/rmdec: Check size in ivr_read_packet() before use

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Thu Jan 14 23:20:58 2016 +0100| [80fd348bb7d9ee55c3100da87795f3a5bcbdfb32] | committer: Michael Niedermayer

avformat/rmdec: Check size in ivr_read_packet() before use

Fixes out of array access
Fixes: asan_heap-oob_445b39_1741_d00eb645ab48eb2203b4a04a5b997103.ivr

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=80fd348bb7d9ee55c3100da87795f3a5bcbdfb32
---

 libavformat/rmdec.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 4e46a3d..ad919e8 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -1357,6 +1357,11 @@ static int ivr_read_packet(AVFormatContext *s, AVPacket *pkt)
                 size = avio_rb32(pb);
                 avio_skip(pb, 4);
 
+                if (size < 1 || size > INT_MAX/4) {
+                    av_log(s, AV_LOG_ERROR, "size %d is invalid\n");
+                    return AVERROR_INVALIDDATA;
+                }
+
                 st = s->streams[index];
                 ret = ff_rm_parse_packet(s, pb, st, st->priv_data, size, pkt,
                                          &seq, 0, pts);