diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-12-31 21:41:46 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-12-31 22:39:31 +0100 |
| commit | 41802887eb647bee21238e0a575a7c4bbf954b86 (patch) | |
| tree | 4bd44b5bde90ffc5413f73f525d95666e460db66 /libavformat/cdxl.c | |
| parent | c27539cd1eaaab1327383cfcbb9ee44b1f9ddaab (diff) | |
| download | ffmpeg-e2de2ae748dff54e78b7bd0236f1bcc64d1546f7.tar.gz | |
avformat/cdxl: Fix integer overflow of image_sizen2.1.7
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3eb5cbe0c50d0a0bbe10bcabbd6b16d73d93c128)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/cdxl.c')
| -rw-r--r-- | libavformat/cdxl.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/cdxl.c b/libavformat/cdxl.c index ab8a846cc5..51b9567d20 100644 --- a/libavformat/cdxl.c +++ b/libavformat/cdxl.c @@ -127,6 +127,8 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt) height = AV_RB16(&cdxl->header[16]); palette_size = AV_RB16(&cdxl->header[20]); audio_size = AV_RB16(&cdxl->header[22]); + if (FFALIGN(width, 16) * (uint64_t)height * cdxl->header[19] > INT_MAX) + return AVERROR_INVALIDDATA; image_size = FFALIGN(width, 16) * height * cdxl->header[19] / 8; video_size = palette_size + image_size; |