From cf5ffe0183947112ac50be81942d8be610aa987c Mon Sep 17 00:00:00 2001 From: Marton Balint Date: Fri, 9 Mar 2018 00:46:06 +0100 Subject: [PATCH] avformat/mxfdec: do not allow more partitions than INT_MAX/2 Some math (e.g: partition binary search) overflows if we have that many parititions. Signed-off-by: Marton Balint --- libavformat/mxfdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 70091e0dc9..7a42555562 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -565,6 +565,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext *pb, int tag, int size uint64_t footer_partition; uint32_t nb_essence_containers; + if (mxf->partitions_count >= INT_MAX / 2) + return AVERROR_INVALIDDATA; + tmp_part = av_realloc_array(mxf->partitions, mxf->partitions_count + 1, sizeof(*mxf->partitions)); if (!tmp_part) return AVERROR(ENOMEM);