On Mon, Mar 26, 2012 at 03:38:05PM +0200, Carl-Eugen Hoyos wrote:
> - if ((startcode >= 0xa0 && startcode <= 0xaf) ||
> + if (startcode == 0xa1) {
> + avio_skip(s->pb, header_length);
> + len -= header_length;
You should probably check that len > header_length.