X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fpjsdec.c;h=1f1d51c4049aa07fbdee66c8f13952b8163cb391;hb=1eb311011548867b118dd461442365195fb5fb7d;hp=bb587b569a1b7362a33578772c3bfb48fd0d1254;hpb=ef71ef5f30ddf1cd61e46628a04608892caf76d2;p=ffmpeg

diff --git a/libavformat/pjsdec.c b/libavformat/pjsdec.c
index bb587b569a1..1f1d51c4049 100644
--- a/libavformat/pjsdec.c
+++ b/libavformat/pjsdec.c
@@ -33,7 +33,7 @@ typedef struct {
     FFDemuxSubtitlesQueue q;
 } PJSContext;
 
-static int pjs_probe(AVProbeData *p)
+static int pjs_probe(const AVProbeData *p)
 {
     char c;
     int64_t start, end;
@@ -55,6 +55,8 @@ static int64_t read_ts(char **line, int *duration)
     if (sscanf(*line, "%"SCNd64",%"SCNd64, &start, &end) == 2) {
         *line += strcspn(*line, "\"");
         *line += !!**line;
+        if (end < start || end - (uint64_t)start > INT_MAX)
+            return AV_NOPTS_VALUE;
         *duration = end - start;
         return start;
     }
@@ -65,7 +67,6 @@ static int pjs_read_header(AVFormatContext *s)
 {
     PJSContext *pjs = s->priv_data;
     AVStream *st = avformat_new_stream(s, NULL);
-    int res = 0;
 
     if (!st)
         return AVERROR(ENOMEM);
@@ -92,8 +93,10 @@ static int pjs_read_header(AVFormatContext *s)
 
             p[strcspn(p, "\"")] = 0;
             sub = ff_subtitles_queue_insert(&pjs->q, p, strlen(p), 0);
-            if (!sub)
+            if (!sub) {
+                ff_subtitles_queue_clean(&pjs->q);
                 return AVERROR(ENOMEM);
+            }
             sub->pos = pos;
             sub->pts = pts_start;
             sub->duration = duration;
@@ -101,7 +104,7 @@ static int pjs_read_header(AVFormatContext *s)
     }
 
     ff_subtitles_queue_finalize(s, &pjs->q);
-    return res;
+    return 0;
 }
 
 static int pjs_read_packet(AVFormatContext *s, AVPacket *pkt)