Message ID | 20221228031958.26570-1-cus@passwd.hu |
---|---|
State | Accepted |
Commit | 6aff3c5e434f91dee9f88541ad2ea73e03bbc583 |
Headers | show |
Series | [FFmpeg-devel,1/3] avformat/mxfdec: check index entry array size | expand |
Context | Check | Description |
---|---|---|
yinshiyou/make_loongarch64 | success | Make finished |
yinshiyou/make_fate_loongarch64 | success | Make fate finished |
andriy/make_x86 | success | Make finished |
andriy/make_fate_x86 | success | Make fate finished |
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index e6118e141d..ad4ee15570 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -1198,11 +1198,15 @@ static int mxf_read_essence_container_data(void *arg, AVIOContext *pb, int tag, static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *segment) { int i, length; + uint32_t nb_index_entries; if (segment->temporal_offset_entries) return AVERROR_INVALIDDATA; - segment->nb_index_entries = avio_rb32(pb); + nb_index_entries = avio_rb32(pb); + if (nb_index_entries > INT_MAX) + return AVERROR_INVALIDDATA; + segment->nb_index_entries = nb_index_entries; length = avio_rb32(pb); if(segment->nb_index_entries && length < 11)
Signed-off-by: Marton Balint <cus@passwd.hu> --- libavformat/mxfdec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)