diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 70091e0dc9..7a42555562 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -565,6 +565,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext *pb, int tag, int size uint64_t footer_partition; uint32_t nb_essence_containers; + if (mxf->partitions_count >= INT_MAX / 2) + return AVERROR_INVALIDDATA; + tmp_part = av_realloc_array(mxf->partitions, mxf->partitions_count + 1, sizeof(*mxf->partitions)); if (!tmp_part) return AVERROR(ENOMEM);