case cfr2_TAG:
/* allocate 8 more bytes than 'size' to account for fourcc
* and size */
- if (size + 8 < size || av_new_packet(pkt, size + 8))
- return AVERROR(EIO);
+ if (size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE - 8)
+ return AVERROR_INVALIDDATA;
+ if ((ret = av_new_packet(pkt, size + 8)) < 0)
+ return ret;
pkt->stream_index = fourxm->video_stream_index;
pkt->pts = fourxm->video_pts;
pkt->pos = avio_tell(s->pb);
fourxm->tracks[track_number].channels > 0) {
ret = av_get_packet(s->pb, pkt, size);
if (ret < 0)
- return AVERROR(EIO);
+ return ret;
pkt->stream_index =
fourxm->tracks[track_number].stream_index;
pkt->pts = fourxm->tracks[track_number].audio_pts;