avformat/mxfdec: avoid index_table->nb_ptses overflow in mxf_compute_ptses_fake_index master
authorMarton Balint <cus@passwd.hu>
Tue, 12 Jun 2018 21:42:16 +0000 (23:42 +0200)
committerMarton Balint <cus@passwd.hu>
Sun, 24 Jun 2018 18:42:35 +0000 (20:42 +0200)
Signed-off-by: Marton Balint <cus@passwd.hu>
libavformat/mxfdec.c

index fb400bf..8c417ae 100644 (file)
@@ -1528,6 +1528,12 @@ static int mxf_compute_ptses_fake_index(MXFContext *mxf, MXFIndexTable *index_ta
             return 0;                               /* no TemporalOffsets */
         }
 
+        if (s->index_duration > INT_MAX - index_table->nb_ptses) {
+            index_table->nb_ptses = 0;
+            av_log(mxf->fc, AV_LOG_ERROR, "ignoring IndexSID %d, duration is too large\n", s->index_sid);
+            return 0;
+        }
+
         index_table->nb_ptses += s->index_duration;
     }