diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-11-06 11:26:51 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-11-10 21:14:23 +0100 |
| commit | 32631852259a8aeb845c39ed7fa707c6e102c40a (patch) | |
| tree | aed874d8b7b099d22edbab85d6b1b9e7dca46d9a /libavcodec/bonk.c | |
| parent | 9f00286c4c133e1709bfd009b76e91e09ec40843 (diff) | |
| download | ffmpeg-32631852259a8aeb845c39ed7fa707c6e102c40a.tar.gz | |
avcodec/bonk: Check step against overflow
No testcase
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/bonk.c')
| -rw-r--r-- | libavcodec/bonk.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c index d2571e56d4..b56a940681 100644 --- a/libavcodec/bonk.c +++ b/libavcodec/bonk.c @@ -180,6 +180,8 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part) if (!dominant) n_zeros += steplet; + if (step > INT32_MAX*8LL/9 + 1) + return AVERROR_INVALIDDATA; step += step / 8; } else if (steplet > 0) { int actual_run = read_uint_max(s, steplet - 1); |