avformat/cdxl: Fix integer overflow of image_size

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
pull/101/head
Michael Niedermayer 10 years ago
parent 975ff6a3c6
commit 3eb5cbe0c5
  1. 2
      libavformat/cdxl.c

@ -130,6 +130,8 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt)
height = AV_RB16(&cdxl->header[16]); height = AV_RB16(&cdxl->header[16]);
palette_size = AV_RB16(&cdxl->header[20]); palette_size = AV_RB16(&cdxl->header[20]);
audio_size = AV_RB16(&cdxl->header[22]); audio_size = AV_RB16(&cdxl->header[22]);
if (FFALIGN(width, 16) * (uint64_t)height * cdxl->header[19] > INT_MAX)
return AVERROR_INVALIDDATA;
image_size = FFALIGN(width, 16) * height * cdxl->header[19] / 8; image_size = FFALIGN(width, 16) * height * cdxl->header[19] / 8;
video_size = palette_size + image_size; video_size = palette_size + image_size;

Loading…
Cancel
Save