int32_t *sample24;
int i, ch, ret;
int blockstodecode;
+ uint64_t decoded_buffer_size;
/* this should never be negative, but bad things will happen if it is, so
check it just to make sure. */
skip_bits_long(&s->gb, offset);
}
- if (!nblocks || nblocks > INT_MAX) {
+ if (!nblocks || nblocks > INT_MAX / 2 / sizeof(*s->decoded_buffer) - 8) {
av_log(avctx, AV_LOG_ERROR, "Invalid sample count: %"PRIu32".\n",
nblocks);
return AVERROR_INVALIDDATA;
blockstodecode = s->samples;
/* reallocate decoded sample buffer if needed */
- av_fast_malloc(&s->decoded_buffer, &s->decoded_size,
- 2 * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer));
+ decoded_buffer_size = 2LL * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer);
+ av_assert0(decoded_buffer_size <= INT_MAX);
+ av_fast_malloc(&s->decoded_buffer, &s->decoded_size, decoded_buffer_size);
if (!s->decoded_buffer)
return AVERROR(ENOMEM);
memset(s->decoded_buffer, 0, s->decoded_size);