提交 295218f5 编写于 作者: P Paul B Mahol

idcin: check chunk_size value before using it

Fixes integer overflow. Fixes CID732223.
Signed-off-by: NPaul B Mahol <onemda@gmail.com>
上级 3f814891
......@@ -256,6 +256,8 @@ static int idcin_read_packet(AVFormatContext *s,
chunk_size = avio_rl32(pb);
/* skip the number of decoded bytes (always equal to width * height) */
avio_skip(pb, 4);
if (chunk_size < 4)
return AVERROR_INVALIDDATA;
chunk_size -= 4;
ret= av_get_packet(pb, pkt, chunk_size);
if (ret < 0)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册