diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2021-02-20 23:42:04 +0100 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2021-02-24 07:50:39 +0100 |
| commit | 1c9e53d70b4a0157af02070c2a6cf4db0c6f6dee (patch) | |
| tree | 3d158e8d97939e5860d82d79196f4bc0fb6029c3 /libavcodec | |
| parent | 78d5e1c6533208b07acf508a4e7f832e3cea8485 (diff) | |
| download | ffmpeg-1c9e53d70b4a0157af02070c2a6cf4db0c6f6dee.tar.gz | |
avcodec/movtextenc: Check for too many styles
The counter for the number of styles is written on two bytes, ergo
anything > UINT16_MAX is invalid. This also fixes a compiler warning
because of a tautologically true check on 64bit systems.
Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/movtextenc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/movtextenc.c b/libavcodec/movtextenc.c index 1bef21e0b9..cf30adbd0a 100644 --- a/libavcodec/movtextenc.c +++ b/libavcodec/movtextenc.c @@ -355,7 +355,7 @@ static int mov_text_style_start(MovTextContext *s) StyleBox *tmp; // last style != defaults, end the style entry and start a new one - if (s->count + 1 > SIZE_MAX / sizeof(*s->style_attributes) || + if (s->count + 1 > FFMIN(SIZE_MAX / sizeof(*s->style_attributes), UINT16_MAX) || !(tmp = av_fast_realloc(s->style_attributes, &s->style_attributes_bytes_allocated, (s->count + 1) * sizeof(*s->style_attributes)))) { |