From e5ece1831a90251be771127cf8f3afff22ee3397 Mon Sep 17 00:00:00 2001
From: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Date: Mon, 26 May 2008 03:53:10 +0000
Subject: [PATCH] return error if len is negative, prevent segfault

Originally committed as revision 13419 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavformat/ffmdec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/ffmdec.c b/libavformat/ffmdec.c
index 1ae24762b6..84bd5e9fba 100644
--- a/libavformat/ffmdec.c
+++ b/libavformat/ffmdec.c
@@ -89,6 +89,8 @@ static int ffm_read_data(AVFormatContext *s,
     while (size > 0) {
     redo:
         len = ffm->packet_end - ffm->packet_ptr;
+        if (len < 0)
+            return -1;
         if (len > size)
             len = size;
         if (len == 0) {