From 33f58c3616d2870d3861da68217ef9d05cc5047a Mon Sep 17 00:00:00 2001 From: Justin Ruggles Date: Wed, 1 Aug 2012 16:10:08 -0400 Subject: [PATCH] idcin: check for integer overflow when calling av_get_packet() chunk_size is unsigned 32-bit, but av_get_packet() takes a signed int as the packet size. --- libavformat/idcin.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavformat/idcin.c b/libavformat/idcin.c index 7a0042b4a1..93ba721d11 100644 --- a/libavformat/idcin.c +++ b/libavformat/idcin.c @@ -278,6 +278,10 @@ static int idcin_read_packet(AVFormatContext *s, } chunk_size = avio_rl32(pb); + if (chunk_size < 4 || chunk_size > INT_MAX - 4) { + av_log(s, AV_LOG_ERROR, "invalid chunk size: %u\n", chunk_size); + return AVERROR_INVALIDDATA; + } /* skip the number of decoded bytes (always equal to width * height) */ avio_skip(pb, 4); chunk_size -= 4; -- 2.20.1