virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-11-21 10:55:51 +02:00
Code Issues Releases Activity

avformat/evcdec: use an unsigned type for nalu_size

Browse Source 
But ensure the value returned by evc_read_nal_unit_length() fits in an int.
Should prevent integer overflows later in the code.

Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2023-06-19 23:47:07 -03:00
parent a6a5e53595
commit d0d20f16ce
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/evcdec.c
View File

@ -181,7 +181,7 @@ fail:
static int evc_read_packet(AVFormatContext *s, AVPacket *pkt) static int evc_read_packet(AVFormatContext *s, AVPacket *pkt)
{ {
int ret; int ret;
int32_t nalu_size; uint32_t nalu_size;
int au_end_found = 0; int au_end_found = 0;
EVCDemuxContext *const c = s->priv_data; EVCDemuxContext *const c = s->priv_data;
@ -200,7 +200,7 @@ static int evc_read_packet(AVFormatContext *s, AVPacket *pkt)
return ret; return ret;
nalu_size = read_nal_unit_length((const uint8_t *)&buf, EVC_NALU_LENGTH_PREFIX_SIZE); nalu_size = read_nal_unit_length((const uint8_t *)&buf, EVC_NALU_LENGTH_PREFIX_SIZE);
if (nalu_size <= 0) if (!nalu_size || nalu_size > INT_MAX)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
avio_seek(s->pb, -EVC_NALU_LENGTH_PREFIX_SIZE, SEEK_CUR); avio_seek(s->pb, -EVC_NALU_LENGTH_PREFIX_SIZE, SEEK_CUR);