diff --git a/libavformat/thp.c b/libavformat/thp.c index d3ae86c645..4abff1313a 100644 --- a/libavformat/thp.c +++ b/libavformat/thp.c @@ -93,6 +93,9 @@ static int thp_read_header(AVFormatContext *s) avio_seek (pb, thp->compoff, SEEK_SET); thp->compcount = avio_rb32(pb); + if (thp->compcount > FF_ARRAY_ELEMS(thp->components)) + return AVERROR_INVALIDDATA; + /* Read the list of component types. */ avio_read(pb, thp->components, 16);