avformat/flvenc: reject text packets too long for an AMF0 string

AV_CODEC_ID_TEXT packets are written as an AMF0 string, whose length is a
16-bit field. For text over 65535 bytes the length wrapped (e.g. 4464 for
70000 bytes) while the whole text was written, so readers misparse the
onTextData tag.

Fail on such packets before writing the tag.
Found while reviewing the metadata length fix for FLV.

Signed-off-by: Martin Mirchev <mmirchev@comp.nus.edu.sg>

libavformat/flvenc.c

@@ -1280,6 +1280,12 @@ static int flv_write_packet(AVFormatContext *s, AVPacket *pkt)
             return AVERROR(EINVAL);
         }
     }
+    /* the text is written as an AMF0 string with a 16-bit length */
+    if (par->codec_id == AV_CODEC_ID_TEXT &&
+        strlen((const char *)pkt->data) > UINT16_MAX) {
+        av_log(s, AV_LOG_ERROR, "Text packet is too long for FLV\n");
+        return AVERROR(EINVAL);
+    }
 
     ts = pkt->dts;