avformat/avidec: check LIST size in avi_load_index()

This avoids an unsigned integer underflow and passing that large value to ff_read_riff_info()
2026-05-02 23:35:49 +02:00
parent f1c3f1cae1
commit 2678bce860
1 changed files with 4 additions and 0 deletions
@@ -1838,6 +1838,10 @@ static int avi_load_index(AVFormatContext *s)
            avi->index_loaded=2;
            ret = 0;
        }else if (tag == MKTAG('L', 'I', 'S', 'T')) {
+            if (size < 4) {
+                av_log(s, AV_LOG_WARNING, "Invalid size (%u) LIST in index\n", size);
+                break;
+            }
            uint32_t tag1 = avio_rl32(pb);

            if (tag1 == MKTAG('I', 'N', 'F', 'O'))