diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c index a84fdc67b1..a19786b4e5 100644 --- a/libavformat/rmdec.c +++ b/libavformat/rmdec.c @@ -199,14 +199,14 @@ static int rm_read_audio_stream_info(AVFormatContext *s, AVIOContext *pb, if (read_all) { codecdata_length = 0; } else { - avio_rb16(pb); avio_r8(pb); - if (version == 5) - avio_r8(pb); - codecdata_length = avio_rb32(pb); - if(codecdata_length + FF_INPUT_BUFFER_PADDING_SIZE <= (unsigned)codecdata_length){ - av_log(s, AV_LOG_ERROR, "codecdata_length too large\n"); - return -1; - } + avio_rb16(pb); avio_r8(pb); + if (version == 5) + avio_r8(pb); + codecdata_length = avio_rb32(pb); + if(codecdata_length + FF_INPUT_BUFFER_PADDING_SIZE <= (unsigned)codecdata_length){ + av_log(s, AV_LOG_ERROR, "codecdata_length too large\n"); + return -1; + } } ast->audio_framesize = st->codec->block_align;