diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-11-15 10:33:40 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-11-20 00:50:06 +0100 |
| commit | 1ed7fcd42af956979abf4e32cd3c9ee17622bbcb (patch) | |
| tree | 93badcae477feccf8a26bdbafc3b7a03f808e41d /libavcodec/hqx.c | |
| parent | 9fb8c5d85344ae4ef02a00b1981b6f7d5e44ab64 (diff) | |
| download | ffmpeg-1ed7fcd42af956979abf4e32cd3c9ee17622bbcb.tar.gz | |
hqx: correct type and size check of info_offset
It is used as size argument of ff_canopus_parse_info_tag, which uses it
as size argument to bytestream2_init, which only supports sizes up to
INT_MAX.
Changing it's type to unsigned simplifies the check.
Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Diffstat (limited to 'libavcodec/hqx.c')
| -rw-r--r-- | libavcodec/hqx.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/hqx.c b/libavcodec/hqx.c index 8060c7a31c..138d960411 100644 --- a/libavcodec/hqx.c +++ b/libavcodec/hqx.c @@ -417,8 +417,8 @@ static int hqx_decode_frame(AVCodecContext *avctx, void *data, info_tag = AV_RL32(src); if (info_tag == MKTAG('I', 'N', 'F', 'O')) { - int info_offset = AV_RL32(src + 4); - if (info_offset > UINT32_MAX - 8 || info_offset + 8 > avpkt->size) { + unsigned info_offset = AV_RL32(src + 4); + if (info_offset > INT_MAX || info_offset + 8 > avpkt->size) { av_log(avctx, AV_LOG_ERROR, "Invalid INFO header offset: 0x%08"PRIX32" is too large.\n", info_offset); |