diff options
| -rw-r--r-- | libavformat/swfdec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/swfdec.c b/libavformat/swfdec.c index 9416187803..f9a164b33f 100644 --- a/libavformat/swfdec.c +++ b/libavformat/swfdec.c @@ -377,6 +377,9 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt) ff_dlog(s, "bitmap: ch=%d fmt=%d %dx%d (linesize=%d) len=%d->%ld pal=%d\n", ch_id, bmp_fmt, width, height, linesize, len, out_len, colormapsize); + if (len * 17373LL < out_len) + goto bitmap_end_skip; + zbuf = av_malloc(len); if (!zbuf) { res = AVERROR(ENOMEM); |