matroskadec: Fix buffer overread in matroska_ebmlnum_uint
Based on a Chromium patch
Originally committed as revision 23168 to svn://svn.ffmpeg.org/ffmpeg/trunk
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 4d18d99..9126717 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -679,7 +679,7 @@
{
ByteIOContext pb;
init_put_byte(&pb, data, size, 0, NULL, NULL, NULL, NULL);
- return ebml_read_num(matroska, &pb, 8, num);
+ return ebml_read_num(matroska, &pb, FFMIN(size, 8), num);
}
/*
