diff --git a/libavcodec/cinepak.c b/libavcodec/cinepak.c index 3c560fdc5f3d30635c144b69a9f760cf293673df..3b00a1605d34c2b4453fc729766bf1a467247703 100644 --- a/libavcodec/cinepak.c +++ b/libavcodec/cinepak.c @@ -274,6 +274,9 @@ static int cinepak_decode_strip (CinepakContext *s, while ((data + 4) <= eod) { chunk_id = BE_16 (&data[0]); chunk_size = BE_16 (&data[2]) - 4; + if(chunk_size < 0) + return -1; + data += 4; chunk_size = ((data + chunk_size) > eod) ? (eod - data) : chunk_size;