fix integer overflows
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
}
for (slice = 0; slice < nslices; slice++) {
}
for (slice = 0; slice < nslices; slice++) {
- int slice_off = AV_RB32(src + tsize + FIC_HEADER_SIZE + slice * 4);
- int slice_size;
+ unsigned slice_off = AV_RB32(src + tsize + FIC_HEADER_SIZE + slice * 4);
+ unsigned slice_size;
int y_off = ctx->slice_h * slice;
int slice_h = ctx->slice_h;
int y_off = ctx->slice_h * slice;
int slice_h = ctx->slice_h;
slice_size = AV_RB32(src + tsize + FIC_HEADER_SIZE + slice * 4 + 4);
}
slice_size = AV_RB32(src + tsize + FIC_HEADER_SIZE + slice * 4 + 4);
}
- slice_size -= slice_off;
-
- if (slice_off > msize || slice_off + slice_size > msize)
+ if (slice_size < slice_off || slice_size > msize)
+ slice_size -= slice_off;
+
ctx->slice_data[slice].src = sdata + slice_off;
ctx->slice_data[slice].src_size = slice_size;
ctx->slice_data[slice].slice_h = slice_h;
ctx->slice_data[slice].src = sdata + slice_off;
ctx->slice_data[slice].src_size = slice_size;
ctx->slice_data[slice].slice_h = slice_h;