rmdec: Avoid allocating huge packets

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 2 insertions, 0 deletions

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 5b9bfb869a..75240236e8 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -24,6 +24,7 @@
 #include "libavutil/dict.h"
 #include "avformat.h"
 #include "internal.h"
+#include "avio_internal.h"
 #include "riff.h"
 #include "rm.h"
 
@@ -612,6 +613,7 @@ static int rm_assemble_video_frame(AVFormatContext *s, AVIOContext *pb,
     }
     if(type != 1){  // not whole frame
         len2 = get_num(pb, &len);
+        len2 = ffio_limit(pb, len2);
         pos  = get_num(pb, &len);
         pic_num = avio_r8(pb); len--;
     }