diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 1f9fa149e1..57fbcd7a1b 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -350,6 +350,8 @@ static void avi_read_nikon(AVFormatContext *s, uint64_t end) uint16_t size = avio_rl16(s->pb); const char *name = NULL; char buffer[64] = { 0 }; + if (avio_tell(s->pb) + size > tag_end) + size = tag_end - avio_tell(s->pb); size -= avio_read(s->pb, buffer, FFMIN(size, sizeof(buffer) - 1)); switch (tag) {