Signed-off-by: Marton Balint <[email protected]>
---
libavformat/mxfdec.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index e6118e141d..ad4ee15570 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1198,11 +1198,15 @@ static int mxf_read_essence_container_data(void *arg,
AVIOContext *pb, int tag,
static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment
*segment)
{
int i, length;
+ uint32_t nb_index_entries;
if (segment->temporal_offset_entries)
return AVERROR_INVALIDDATA;
- segment->nb_index_entries = avio_rb32(pb);
+ nb_index_entries = avio_rb32(pb);
+ if (nb_index_entries > INT_MAX)
+ return AVERROR_INVALIDDATA;
+ segment->nb_index_entries = nb_index_entries;
length = avio_rb32(pb);
if(segment->nb_index_entries && length < 11)
--
2.35.3
_______________________________________________
ffmpeg-devel mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
