From c73685398dee3290dd9f67013f1cd310b7f9fb33 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Mon, 10 Dec 2012 17:20:32 +0100
Subject: [PATCH] swfdec: check lens validity

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
 libavformat/swfdec.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavformat/swfdec.c b/libavformat/swfdec.c
index b8100cb3fe..eb71208060 100644
--- a/libavformat/swfdec.c
+++ b/libavformat/swfdec.c
@@ -155,6 +155,10 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
         tag = get_swf_tag(pb, &len);
         if (tag < 0)
             return tag;
+        if (len < 0) {
+            av_log(s, AV_LOG_ERROR, "len %d is invalid\n", len);
+            return AVERROR_INVALIDDATA;
+        }
         if (tag == TAG_VIDEOSTREAM) {
             int ch_id = avio_rl16(pb);
             len -= 2;