Fixes: half of CID1258461 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/siff.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavformat/siff.c b/libavformat/siff.c
index 5aad03d870f..b33746d51d2 100644
--- a/libavformat/siff.c
+++ b/libavformat/siff.c
@@ -199,7 +199,10 @@ static int siff_read_packet(AVFormatContext *s, AVPacket
*pkt)
if (c->cur_frame >= c->frames)
return AVERROR_EOF;
if (c->curstrm == -1) {
- c->pktsize = avio_rl32(s->pb) - 4;
+ unsigned pktsize = avio_rl32(s->pb);
+ if (pktsize < 4)
+ return AVERROR_INVALIDDATA;
+ c->pktsize = pktsize - 4;
c->flags = avio_rl16(s->pb);
if (c->flags & VB_HAS_AUDIO && !c->has_audio)
return AVERROR_INVALIDDATA;
--
2.45.2
_______________________________________________
ffmpeg-devel mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
