commit 4f209fe9606a4fb73f2f10d9106a8e990dac3b8d
author Michael Niedermayer <michaelni@gmx.at> Wed Nov 16 17:21:42 2011 +0100
committer Michael Niedermayer <michaelni@gmx.at> Mon Nov 21 21:59:34 2011 +0100
tree 616d15b5792a35c04fedaf2b87c0a3f59811e442
parent 037b1142cde54e64c8de2a5fd79c259a36b5e244

cinepak: check strip_size

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cea0c82d9b9771dfa2ac729c13c0d9e03ea352a7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 211a107208ee636da81d2a89592181e2d78a0c8c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/cinepak.c

diff --git a/libavcodec/cinepak.c b/libavcodec/cinepak.c
index c248f00..f6d457d 100644
--- a/libavcodec/cinepak.c
+++ b/libavcodec/cinepak.c
@@ -366,6 +366,8 @@
         s->strips[i].x2 = s->avctx->width;
 
         strip_size = AV_RB24 (&s->data[1]) - 12;
+        if(strip_size < 0)
+            return -1;
         s->data   += 12;
         strip_size = ((s->data + strip_size) > eod) ? (eod - s->data) : strip_size;