av_log(s, AV_LOG_WARNING, "Invalid APE tag key '%s'.\n", key);
return -1;
}
- if (size >= UINT_MAX)
- return -1;
+ if (size > INT32_MAX - FF_INPUT_BUFFER_PADDING_SIZE) {
+ av_log(s, AV_LOG_ERROR, "APE tag size too large.\n");
+ return AVERROR_INVALIDDATA;
+ }
if (flags & APE_TAG_FLAG_IS_BINARY) {
uint8_t filename[1024];
enum AVCodecID id;