avformat/idroqdec: Check chunk_size for being too large

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 744a0b5206) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-11-29 02:58:34 +01:00 · 2016-11-29 02:58:34 +01:00 · 5497fa83f9
parent 8e7f5ecfca
commit 5497fa83f9
1 changed files with 3 additions and 0 deletions
--- a/libavformat/idroqdec.c
+++ b/libavformat/idroqdec.c
@ -157,6 +157,9 @@ static int roq_read_packet(AVFormatContext *s,
            chunk_size = AV_RL32(&preamble[2]) + RoQ_CHUNK_PREAMBLE_SIZE * 2 +
                codebook_size;

+            if (chunk_size > INT_MAX)
+                return AVERROR_INVALIDDATA;
+
            /* rewind */
            avio_seek(pb, codebook_offset, SEEK_SET);