avformat/avidec: check LIST size in avi_load_index()

This avoids an unsigned integer underflow and passing that large value to ff_read_riff_info()

(cherry picked from commit 2678bce860)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

libavformat/avidec.c

@@ -1814,6 +1814,10 @@ static int avi_load_index(AVFormatContext *s)
             avi->index_loaded=2;
             ret = 0;
         }else if (tag == MKTAG('L', 'I', 'S', 'T')) {
+            if (size < 4) {
+                av_log(s, AV_LOG_WARNING, "Invalid size (%u) LIST in index\n", size);
+                break;
+            }
             uint32_t tag1 = avio_rl32(pb);
 
             if (tag1 == MKTAG('I', 'N', 'F', 'O'))