From 6aff3c5e434f91dee9f88541ad2ea73e03bbc583 Mon Sep 17 00:00:00 2001 From: Marton Balint Date: Wed, 28 Dec 2022 02:36:57 +0100 Subject: [PATCH] avformat/mxfdec: check index entry array size Signed-off-by: Marton Balint --- libavformat/mxfdec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index fa58854fcd..d843802f28 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -1198,11 +1198,15 @@ static int mxf_read_essence_container_data(void *arg, AVIOContext *pb, int tag, static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *segment) { int i, length; + uint32_t nb_index_entries; if (segment->temporal_offset_entries) return AVERROR_INVALIDDATA; - segment->nb_index_entries = avio_rb32(pb); + nb_index_entries = avio_rb32(pb); + if (nb_index_entries > INT_MAX) + return AVERROR_INVALIDDATA; + segment->nb_index_entries = nb_index_entries; length = avio_rb32(pb); if(segment->nb_index_entries && length < 11)