X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fcdxl.c;h=e675b2c8f10118f6431344b431479447a9b2fd08;hb=d92b2296f85467af25b0ec95a6d6f6327db9e056;hp=94a063c81311b09fd8b6e94ec7f5ed69685724d4;hpb=c0a647644f2703e1da980dcf988cefd81528d8c9;p=ffmpeg

diff --git a/libavformat/cdxl.c b/libavformat/cdxl.c
index 94a063c8131..e675b2c8f10 100644
--- a/libavformat/cdxl.c
+++ b/libavformat/cdxl.c
@@ -40,7 +40,7 @@ typedef struct CDXLDemuxContext {
     int64_t     filesize;
 } CDXLDemuxContext;
 
-static int cdxl_read_probe(AVProbeData *p)
+static int cdxl_read_probe(const AVProbeData *p)
 {
     int score = AVPROBE_SCORE_EXTENSION + 10;
 
@@ -131,7 +131,8 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt)
     height       = AV_RB16(&cdxl->header[16]);
     palette_size = AV_RB16(&cdxl->header[20]);
     audio_size   = AV_RB16(&cdxl->header[22]);
-    if (FFALIGN(width, 16) * (uint64_t)height * cdxl->header[19] > INT_MAX)
+    if (cdxl->header[19] == 0 ||
+        FFALIGN(width, 16) * (uint64_t)height * cdxl->header[19] > INT_MAX)
         return AVERROR_INVALIDDATA;
     if (format == 0x20)
         image_size = width * height * cdxl->header[19] / 8;