From e71dce5769b2282824da7cfd6f7e4ce0d1985876 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 9 Mar 2015 21:05:29 +0100 Subject: [PATCH] avformat/siff: Fix checks and variable types Signed-off-by: Michael Niedermayer --- libavformat/siff.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavformat/siff.c b/libavformat/siff.c index a7c3a8bacd..b6ea390598 100644 --- a/libavformat/siff.c +++ b/libavformat/siff.c @@ -56,7 +56,7 @@ typedef struct SIFFContext { int curstrm; unsigned int pktsize; int gmcsize; - int sndsize; + unsigned int sndsize; unsigned int flags; uint8_t gmc[4]; @@ -208,10 +208,11 @@ static int siff_read_packet(AVFormatContext *s, AVPacket *pkt) } if (!c->curstrm) { + if (c->pktsize < 2LL + c->sndsize + c->gmcsize) + return AVERROR_INVALIDDATA; + size = c->pktsize - c->sndsize - c->gmcsize - 2; size = ffio_limit(s->pb, size); - if (size < 0 || c->pktsize < c->sndsize) - return AVERROR_INVALIDDATA; if (av_new_packet(pkt, size + c->gmcsize + 2) < 0) return AVERROR(ENOMEM); AV_WL16(pkt->data, c->flags);