diff --git a/libavformat/avidec.c b/libavformat/avidec.c index db01244853..4b48bb1a08 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -1838,6 +1838,10 @@ static int avi_load_index(AVFormatContext *s) avi->index_loaded=2; ret = 0; }else if (tag == MKTAG('L', 'I', 'S', 'T')) { + if (size < 4) { + av_log(s, AV_LOG_WARNING, "Invalid size (%u) LIST in index\n", size); + break; + } uint32_t tag1 = avio_rl32(pb); if (tag1 == MKTAG('I', 'N', 'F', 'O'))