avformat/cdxl: Fix integer overflow of image_size
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
975ff6a3c6
commit
3eb5cbe0c5
@ -130,6 +130,8 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt)
|
|||||||
height = AV_RB16(&cdxl->header[16]);
|
height = AV_RB16(&cdxl->header[16]);
|
||||||
palette_size = AV_RB16(&cdxl->header[20]);
|
palette_size = AV_RB16(&cdxl->header[20]);
|
||||||
audio_size = AV_RB16(&cdxl->header[22]);
|
audio_size = AV_RB16(&cdxl->header[22]);
|
||||||
|
if (FFALIGN(width, 16) * (uint64_t)height * cdxl->header[19] > INT_MAX)
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
image_size = FFALIGN(width, 16) * height * cdxl->header[19] / 8;
|
image_size = FFALIGN(width, 16) * height * cdxl->header[19] / 8;
|
||||||
video_size = palette_size + image_size;
|
video_size = palette_size + image_size;
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user