avformat/idroqdec: Check chunk_size for being too large
authorMichael Niedermayer <michael@niedermayer.cc>
Tue, 29 Nov 2016 01:58:34 +0000 (02:58 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Tue, 29 Nov 2016 18:26:26 +0000 (19:26 +0100)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/idroqdec.c

index b664279..83701b5 100644 (file)
@@ -157,6 +157,9 @@ static int roq_read_packet(AVFormatContext *s,
             chunk_size = AV_RL32(&preamble[2]) + RoQ_CHUNK_PREAMBLE_SIZE * 2 +
                 codebook_size;
 
+            if (chunk_size > INT_MAX)
+                return AVERROR_INVALIDDATA;
+
             /* rewind */
             avio_seek(pb, codebook_offset, SEEK_SET);