Commit cf5ffe01 authored by Marton Balint's avatar Marton Balint

avformat/mxfdec: do not allow more partitions than INT_MAX/2

Some math (e.g: partition binary search) overflows if we have that many
parititions.
Signed-off-by: 's avatarMarton Balint <cus@passwd.hu>
parent 90756e67
......@@ -565,6 +565,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext *pb, int tag, int size
uint64_t footer_partition;
uint32_t nb_essence_containers;
if (mxf->partitions_count >= INT_MAX / 2)
return AVERROR_INVALIDDATA;
tmp_part = av_realloc_array(mxf->partitions, mxf->partitions_count + 1, sizeof(*mxf->partitions));
if (!tmp_part)
return AVERROR(ENOMEM);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment