if (version == 5)
avio_r8(pb);
codecdata_length = avio_rb32(pb);
- if(codecdata_length + AV_INPUT_BUFFER_PADDING_SIZE <= (unsigned)codecdata_length){
+ if((unsigned)codecdata_length > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE){
av_log(s, AV_LOG_ERROR, "codecdata_length too large\n");
return -1;
}
int j;
av_log(s, AV_LOG_DEBUG, "%s = '0x", key);
- for (j = 0; j < len; j++)
+ for (j = 0; j < len; j++) {
+ if (avio_feof(pb))
+ return AVERROR_INVALIDDATA;
av_log(s, AV_LOG_DEBUG, "%X", avio_r8(pb));
+ }
av_log(s, AV_LOG_DEBUG, "'\n");
} else if (len == 4 && type == 3 && !strncmp(key, "Duration", tlen)) {
st->duration = avio_rb32(pb);