diff options
| author | Marton Balint <cus@passwd.hu> | 2022-12-28 02:36:57 +0100 |
|---|---|---|
| committer | Marton Balint <cus@passwd.hu> | 2023-01-29 18:58:30 +0100 |
| commit | 6aff3c5e434f91dee9f88541ad2ea73e03bbc583 (patch) | |
| tree | c636de8ec28f9d34acd5c3f86338b8a1c219dbf7 /libavformat/mxfdec.c | |
| parent | 757218564dd50b462fab4cb6aa225d7bbdb2f94c (diff) | |
avformat/mxfdec: check index entry array size
Signed-off-by: Marton Balint <cus@passwd.hu>
Diffstat (limited to 'libavformat/mxfdec.c')
| -rw-r--r-- | libavformat/mxfdec.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index fa58854fcd..d843802f28 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -1198,11 +1198,15 @@ static int mxf_read_essence_container_data(void *arg, AVIOContext *pb, int tag, static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *segment) { int i, length; + uint32_t nb_index_entries; if (segment->temporal_offset_entries) return AVERROR_INVALIDDATA; - segment->nb_index_entries = avio_rb32(pb); + nb_index_entries = avio_rb32(pb); + if (nb_index_entries > INT_MAX) + return AVERROR_INVALIDDATA; + segment->nb_index_entries = nb_index_entries; length = avio_rb32(pb); if(segment->nb_index_entries && length < 11) |