X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Flrcdec.c;h=678b6184987ff9134fd7fd858d7cfdfcce7d2967;hb=bc70684e74a185d7b80c8b80bdedda659cb581b8;hp=f4e9a4efa9118f12cba0fe5d17126da9a03bb1e2;hpb=1c9ac700dd141e545538a824f5a8cb81bb0a375d;p=ffmpeg

diff --git a/libavformat/lrcdec.c b/libavformat/lrcdec.c
index f4e9a4efa91..678b6184987 100644
--- a/libavformat/lrcdec.c
+++ b/libavformat/lrcdec.c
@@ -116,7 +116,7 @@ static int64_t read_line(AVBPrint *buf, AVIOContext *pb)
     return pos;
 }
 
-static int lrc_probe(AVProbeData *p)
+static int lrc_probe(const AVProbeData *p)
 {
     int64_t offset = 0;
     int64_t mm;
@@ -185,6 +185,8 @@ static int lrc_read_header(AVFormatContext *s)
                    sscanf(comma_offset + 1, "%"SCNd64, &lrc->ts_offset) != 1) {
                     av_dict_set(&s->metadata, line.str + 1, comma_offset + 1, 0);
                 }
+                lrc->ts_offset = av_clip64(lrc->ts_offset, INT64_MIN/4, INT64_MAX/4);
+
                 *comma_offset = ':';
                 *right_bracket_offset = ']';
             }
@@ -198,10 +200,12 @@ static int lrc_read_header(AVFormatContext *s)
 
             while((ts_stroffset_incr = read_ts(line.str + ts_stroffset,
                                                &ts_start)) != 0) {
+                ts_start = av_clip64(ts_start, INT64_MIN/4, INT64_MAX/4);
                 ts_stroffset += ts_stroffset_incr;
                 sub = ff_subtitles_queue_insert(&lrc->q, line.str + ts_strlength,
                                                 line.len - ts_strlength, 0);
                 if(!sub) {
+                    ff_subtitles_queue_clean(&lrc->q);
                     return AVERROR(ENOMEM);
                 }
                 sub->pos = pos;
@@ -237,7 +241,7 @@ static int lrc_read_close(AVFormatContext *s)
     return 0;
 }
 
-AVInputFormat ff_lrc_demuxer = {
+const AVInputFormat ff_lrc_demuxer = {
     .name           = "lrc",
     .long_name      = NULL_IF_CONFIG_SMALL("LRC lyrics"),
     .priv_data_size = sizeof (LRCContext),