avformat/mxfdec: do not allow more partitions than INT_MAX/2
authorMarton Balint <cus@passwd.hu>
Thu, 8 Mar 2018 23:46:06 +0000 (00:46 +0100)
committerMarton Balint <cus@passwd.hu>
Fri, 9 Mar 2018 19:37:49 +0000 (20:37 +0100)
Some math (e.g: partition binary search) overflows if we have that many
parititions.

Signed-off-by: Marton Balint <cus@passwd.hu>
libavformat/mxfdec.c

index 70091e0..7a42555 100644 (file)
@@ -565,6 +565,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext *pb, int tag, int size
     uint64_t footer_partition;
     uint32_t nb_essence_containers;
 
+    if (mxf->partitions_count >= INT_MAX / 2)
+        return AVERROR_INVALIDDATA;
+
     tmp_part = av_realloc_array(mxf->partitions, mxf->partitions_count + 1, sizeof(*mxf->partitions));
     if (!tmp_part)
         return AVERROR(ENOMEM);