Skip to content

F
ffmpeg.wasm-core
Commit 297e65c6 authored by Paul B Mahol's avatar Paul B Mahol
Browse files
Options

avformat/vividas: check if value from ffio_read_varlen() is too big

parent 53d3a1c5
Hide whitespace changes
Inline Side-by-side
Showing with 6 additions and 2 deletions
libavformat/vividas.c
View file @ 297e65c6
...@@ -618,9 +618,11 @@ static int viv_read_packet(AVFormatContext *s, ...@@ -618,9 +618,11 @@ static int viv_read_packet(AVFormatContext *s,
off += viv->sb_entries[viv->current_sb_entry].size; off += viv->sb_entries[viv->current_sb_entry].size;
if (viv->sb_entries[viv->current_sb_entry].flag == 0) { if (viv->sb_entries[viv->current_sb_entry].flag == 0) {
int v_size = ffio_read_varlen(pb); uint64_t v_size = ffio_read_varlen(pb);
ffio_read_varlen(pb); ffio_read_varlen(pb);
if (v_size > INT_MAX)
return AVERROR_INVALIDDATA;
ret = av_get_packet(pb, pkt, v_size); ret = av_get_packet(pb, pkt, v_size);
if (ret < 0) if (ret < 0)
return ret; return ret;
...@@ -646,8 +648,10 @@ static int viv_read_packet(AVFormatContext *s, ...@@ -646,8 +648,10 @@ static int viv_read_packet(AVFormatContext *s,
viv->current_audio_subpacket = 0; viv->current_audio_subpacket = 0;
} else { } else {
int v_size = ffio_read_varlen(pb); uint64_t v_size = ffio_read_varlen(pb);
if (v_size > INT_MAX)
return AVERROR_INVALIDDATA;
ret = av_get_packet(pb, pkt, v_size); ret = av_get_packet(pb, pkt, v_size);
if (ret < 0) if (ret < 0)
return ret; return ret;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment