jvdec: check that the video_size fits in the packet.

Prevents use of out of array data and fate failure.

Found-by: durandal_1707
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/jvdec.c

@@ -143,7 +143,7 @@ static int decode_frame(AVCodecContext *avctx,
     buf += 5;
 
     if (video_size) {
-        if(video_size < 0) {
+        if(video_size < 0 || video_size > buf_size) {
             av_log(avctx, AV_LOG_ERROR, "video size %d invalid\n", video_size);
             return AVERROR_INVALIDDATA;
         }

tests/ref/fate/jv

@@ -6,4 +6,3 @@
 0,          5,          5,        1,   192000, 0xb8e331eb
 0,          6,          6,        1,   192000, 0xd35b2053
 0,          7,          7,        1,   192000, 0x01062188
-0,          8,          8,        1,   192000, 0xa3a73b87