diff options
| author | Marton Balint <cus@passwd.hu> | 2018-03-09 00:46:06 +0100 |
|---|---|---|
| committer | Marton Balint <cus@passwd.hu> | 2018-03-09 20:37:49 +0100 |
| commit | cf5ffe0183947112ac50be81942d8be610aa987c (patch) | |
| tree | 3c6f850b5218fb404b7209481a78b07bf208488d /libavformat/mxfdec.c | |
| parent | 90756e67a0a1de762d27c2fe01a30ac8434a3631 (diff) | |
avformat/mxfdec: do not allow more partitions than INT_MAX/2
Some math (e.g: partition binary search) overflows if we have that many
parititions.
Signed-off-by: Marton Balint <cus@passwd.hu>
Diffstat (limited to 'libavformat/mxfdec.c')
| -rw-r--r-- | libavformat/mxfdec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 70091e0dc9..7a42555562 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -565,6 +565,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext *pb, int tag, int size uint64_t footer_partition; uint32_t nb_essence_containers; + if (mxf->partitions_count >= INT_MAX / 2) + return AVERROR_INVALIDDATA; + tmp_part = av_realloc_array(mxf->partitions, mxf->partitions_count + 1, sizeof(*mxf->partitions)); if (!tmp_part) return AVERROR(ENOMEM); |