rpza: check that declared size does not exceed real size

Old versions of the codec used only part of fixed-size frames.

diff --git a/nihav-qt/src/codecs/rpza.rs b/nihav-qt/src/codecs/rpza.rs
index fdbbb80e66bbcfedf0270cdff11f0a348f237ad9..8b6f4742b6bd532f63d2be5272e41373831977e8 100644 (file)
--- a/nihav-qt/src/codecs/rpza.rs
+++ b/nihav-qt/src/codecs/rpza.rs
@@ -51,13 +51,13 @@ impl NADecoder for RpzaDecoder {
     }
     fn decode(&mut self, _supp: &mut NADecoderSupport, pkt: &NAPacket) -> DecoderResult<NAFrameRef> {
         let src = pkt.get_buffer();
-        validate!(src.len() >= 2);
+        validate!(src.len() >= 4);
         let mut br = MemoryReader::new_read(src.as_slice());
 
         let id                          = br.read_byte()?;
         validate!(id == 0xE1);
         let length                      = br.read_u24be()? as usize;
-        validate!(length == src.len());
+        validate!(length >= 4 && length <= src.len());
 
         let bufret = self.hams.clone_ref();
         let mut buf;
@@ -157,6 +157,9 @@ impl NADecoder for RpzaDecoder {
             };
             blockpos += len;
         }
+        if length < src.len() {
+            validate!(br.tell() <= (length as u64));
+        }
 
         let buftype = NABufferType::Video16(buf);