size_t running_size = 0;
for (i = 0; i < ctx->chunk_count; i++) {
ctx->chunks[i].compressed_offset = running_size;
+ if (ctx->chunks[i].compressed_size > UINT32_MAX - running_size)
+ return AVERROR_INVALIDDATA;
running_size += ctx->chunks[i].compressed_size;
}
}
HapChunk *chunk = &ctx->chunks[i];
/* Check the compressed buffer is valid */
- if (chunk->compressed_offset + chunk->compressed_size > bytestream2_get_bytes_left(gbc))
+ if (chunk->compressed_offset + (uint64_t)chunk->compressed_size > bytestream2_get_bytes_left(gbc))
return AVERROR_INVALIDDATA;
/* Chunks are unpacked sequentially, ctx->tex_size is the uncompressed
return 0;
}
-AVCodec ff_hap_decoder = {
+const AVCodec ff_hap_decoder = {
.name = "hap",
.long_name = NULL_IF_CONFIG_SMALL("Vidvox Hap"),
.type = AVMEDIA_TYPE_VIDEO,