avi: reject chunks larger than remaining movi size

diff --git a/nihav-commonfmt/src/demuxers/avi.rs b/nihav-commonfmt/src/demuxers/avi.rs
index 44d68f8376585a6fcccaf398a103ee50bed51f6c..40290abe7ca5bc28edd8c1252c1845d4443d2cd2 100644 (file)
--- a/nihav-commonfmt/src/demuxers/avi.rs
+++ b/nihav-commonfmt/src/demuxers/avi.rs
@@ -609,6 +609,10 @@ impl<'a> DemuxCore<'a> for AVIDemuxer<'a> {
             let is_keyframe = self.state.key_offs.binary_search(&self.src.tell()).is_ok();
             let tag = self.src.read_tag()?;
             let size = self.src.read_u32le()? as usize;
+            if size > self.state.movi_size {
+                self.state.movi_size = 0;
+                return Err(InvalidData);
+            }
             match &tag {
                 b"JUNK" => {
                     self.state.movi_size -= size + 8;