ffmpeg | branch: master | Marton Balint <[email protected]> | Wed Dec 28 02:36:57 2022 +0100| [6aff3c5e434f91dee9f88541ad2ea73e03bbc583] | committer: Marton Balint
avformat/mxfdec: check index entry array size Signed-off-by: Marton Balint <[email protected]> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6aff3c5e434f91dee9f88541ad2ea73e03bbc583 --- libavformat/mxfdec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index fa58854fcd..d843802f28 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -1198,11 +1198,15 @@ static int mxf_read_essence_container_data(void *arg, AVIOContext *pb, int tag, static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *segment) { int i, length; + uint32_t nb_index_entries; if (segment->temporal_offset_entries) return AVERROR_INVALIDDATA; - segment->nb_index_entries = avio_rb32(pb); + nb_index_entries = avio_rb32(pb); + if (nb_index_entries > INT_MAX) + return AVERROR_INVALIDDATA; + segment->nb_index_entries = nb_index_entries; length = avio_rb32(pb); if(segment->nb_index_entries && length < 11) _______________________________________________ ffmpeg-cvslog mailing list [email protected] https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email [email protected] with subject "unsubscribe".
