On Mon, Mar 26, 2012 at 03:38:05PM +0200, Carl-Eugen Hoyos wrote: > - if ((startcode >= 0xa0 && startcode <= 0xaf) || > + if (startcode == 0xa1) { > + avio_skip(s->pb, header_length); > + len -= header_length; You should probably check that len > header_length.