pos = avio_tell(pb);
*tag = avio_rl16(pb);
*size = ffio_read_varlen(pb);
- *size -= avio_tell(pb) - pos;
+ pos -= avio_tell(pb);
+ if (av_sat_add64(*size, pos) != (uint64_t)*size + pos) {
+ *size = -1;
+ } else
+ *size += pos;
}
static void mpc8_parse_seektable(AVFormatContext *s, int64_t off)
av_add_index_entry(s->streams[0], pos, i, 0, 0, AVINDEX_KEYFRAME);
}
for(; i < size; i++){
+ if (get_bits_left(&gb) < 13) {
+ av_free(buf);
+ return;
+ }
t = get_unary(&gb, 1, 33) << 12;
t += get_bits(&gb, 12);
if(t & 1)
return AVERROR_EOF;
mpc8_get_chunk_header(s->pb, &tag, &size);
- if (size < 0)
+ if (size < 0 || size > INT_MAX)
return -1;
if(tag == TAG_AUDIOPACKET){
if ((ret = av_get_packet(s->pb, pkt, size)) < 0)