repositories
/
deb_ffmpeg.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Imported Debian version 2.5.3~trusty1
[deb_ffmpeg.git]
/
ffmpeg
/
libavformat
/
cdxl.c
diff --git
a/ffmpeg/libavformat/cdxl.c
b/ffmpeg/libavformat/cdxl.c
index e3e379aef772cd7c7efd24bb7264bfca871030e4..6d8e750b830704170c585a0d7f90a3e4e0094107 100644
(file)
--- a/
ffmpeg/libavformat/cdxl.c
+++ b/
ffmpeg/libavformat/cdxl.c
@@
-127,6
+127,8
@@
static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt)
height = AV_RB16(&cdxl->header[16]);
palette_size = AV_RB16(&cdxl->header[20]);
audio_size = AV_RB16(&cdxl->header[22]);
height = AV_RB16(&cdxl->header[16]);
palette_size = AV_RB16(&cdxl->header[20]);
audio_size = AV_RB16(&cdxl->header[22]);
+ if (FFALIGN(width, 16) * (uint64_t)height * cdxl->header[19] > INT_MAX)
+ return AVERROR_INVALIDDATA;
image_size = FFALIGN(width, 16) * height * cdxl->header[19] / 8;
video_size = palette_size + image_size;
image_size = FFALIGN(width, 16) * height * cdxl->header[19] / 8;
video_size = palette_size + image_size;