@@ -523,7 +523,7 @@ static int decode_byterun2(uint8_t *dst, int height, int line_size,
GetByteContext *gb)
{
GetByteContext cmds;
- unsigned count;
+ int count;
int i, y_pos = 0, x_pos = 0;
if (bytestream2_get_be32(gb) != MKBETAG('V', 'D', 'A', 'T'))
@@ -531,7 +531,7 @@ static int decode_byterun2(uint8_t *dst, int height, int line_size,
bytestream2_skip(gb, 4);
count = bytestream2_get_be16(gb) - 2;
- if (bytestream2_get_bytes_left(gb) < count)
+ if (count < 0 || bytestream2_get_bytes_left(gb) < count)
return 0;
bytestream2_init(&cmds, gb->buffer, count);
This is more a style fix than a bugfix (CID1604392 Overflowed constant) Sponsored-by: Sovereign Tech Fund Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/iff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)