@@ -289,15 +289,23 @@ static int parse_fmtp(AVFormatContext *s,
for (i = 0; attr_names[i].str; ++i) {
if (!av_strcasecmp(attr, attr_names[i].str)) {
if (attr_names[i].type == ATTR_NAME_TYPE_INT) {
- int val = atoi(value);
- if (val > 32) {
+ char *end_ptr = NULL;
+ long int val = strtol(value, &end_ptr, 10);
+ if (value[0] == '\n' || end_ptr[0] != '\0') {
av_log(s, AV_LOG_ERROR,
- "The %s field size is invalid (%d)\n",
+ "The %s field value is not a number (%s)\n",
+ attr, value);
+ return AVERROR_INVALIDDATA;
+ }
+
+ if (val > INT_MAX || val < INT_MIN) {
+ av_log(s, AV_LOG_ERROR,
+ "The %s field size is invalid (%ld)\n",
attr, val);
return AVERROR_INVALIDDATA;
}
*(int *)((char *)data+
- attr_names[i].offset) = val;
+ attr_names[i].offset) = (int) val;
} else if (attr_names[i].type == ATTR_NAME_TYPE_STR) {
char *val = av_strdup(value);
if (!val)