diff options
Diffstat (limited to 'libavformat/iff.c')
| -rw-r--r-- | libavformat/iff.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavformat/iff.c b/libavformat/iff.c index 5b0d3ff18d..1efc1472cc 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -250,8 +250,11 @@ static int iff_read_header(AVFormatContext *s) break; case ID_CMAP: - if (data_size > INT_MAX - IFF_EXTRA_VIDEO_SIZE - FF_INPUT_BUFFER_PADDING_SIZE) - return AVERROR_INVALIDDATA; + if (data_size < 3 || data_size > 768 || data_size % 3) { + av_log(s, AV_LOG_ERROR, "Invalid CMAP chunk size %d\n", + data_size); + return AVERROR_INVALIDDATA; + } st->codec->extradata_size = data_size + IFF_EXTRA_VIDEO_SIZE; st->codec->extradata = av_malloc(data_size + IFF_EXTRA_VIDEO_SIZE + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) |