X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fsamidec.c;h=cf5076c7b817145483ea3e0776be56ef030f7bd4;hb=cb789fd2b34864df30bc4b664cfee632dca0a1e4;hp=7ea1bdfdd97e3166b851c5151bf90d8edd7b3995;hpb=f3881c04e93ee70567bd3fe087f49b996b026d30;p=ffmpeg

diff --git a/libavformat/samidec.c b/libavformat/samidec.c
index 7ea1bdfdd97..cf5076c7b81 100644
--- a/libavformat/samidec.c
+++ b/libavformat/samidec.c
@@ -36,7 +36,7 @@ typedef struct {
     FFDemuxSubtitlesQueue q;
 } SAMIContext;
 
-static int sami_probe(AVProbeData *p)
+static int sami_probe(const AVProbeData *p)
 {
     char buf[6];
     FFTextReader tr;
@@ -95,6 +95,11 @@ static int sami_read_header(AVFormatContext *s)
                 const char *p = ff_smil_get_attr_ptr(buf.str, "Start");
                 sub->pos      = pos;
                 sub->pts      = p ? strtol(p, NULL, 10) : 0;
+                if (sub->pts <= INT64_MIN/2 || sub->pts >= INT64_MAX/2) {
+                    res = AVERROR_PATCHWELCOME;
+                    goto end;
+                }
+
                 sub->duration = -1;
             }
         }
@@ -108,6 +113,8 @@ static int sami_read_header(AVFormatContext *s)
     ff_subtitles_queue_finalize(s, &sami->q);
 
 end:
+    if (res < 0)
+        ff_subtitles_queue_clean(&sami->q);
     av_bprint_finalize(&buf, NULL);
     return res;
 }