X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fsamidec.c;h=d84f56ce6fae99546a489e61518ae959d934fe25;hb=2086d635c36c2865d1a0145c56e448b30af59ba0;hp=7ea1bdfdd97e3166b851c5151bf90d8edd7b3995;hpb=64425e005edf3bdd77c34c078c3e74ab5ecef557;p=ffmpeg

diff --git a/libavformat/samidec.c b/libavformat/samidec.c
index 7ea1bdfdd97..d84f56ce6fa 100644
--- a/libavformat/samidec.c
+++ b/libavformat/samidec.c
@@ -36,7 +36,7 @@ typedef struct {
     FFDemuxSubtitlesQueue q;
 } SAMIContext;
 
-static int sami_probe(AVProbeData *p)
+static int sami_probe(const AVProbeData *p)
 {
     char buf[6];
     FFTextReader tr;
@@ -89,12 +89,19 @@ static int sami_read_header(AVFormatContext *s)
             sub = ff_subtitles_queue_insert(&sami->q, buf.str, buf.len, !is_sync);
             if (!sub) {
                 res = AVERROR(ENOMEM);
+                av_bprint_finalize(&hdr_buf, NULL);
                 goto end;
             }
             if (is_sync) {
                 const char *p = ff_smil_get_attr_ptr(buf.str, "Start");
                 sub->pos      = pos;
                 sub->pts      = p ? strtol(p, NULL, 10) : 0;
+                if (sub->pts <= INT64_MIN/2 || sub->pts >= INT64_MAX/2) {
+                    res = AVERROR_PATCHWELCOME;
+                    av_bprint_finalize(&hdr_buf, NULL);
+                    goto end;
+                }
+
                 sub->duration = -1;
             }
         }
@@ -108,6 +115,8 @@ static int sami_read_header(AVFormatContext *s)
     ff_subtitles_queue_finalize(s, &sami->q);
 
 end:
+    if (res < 0)
+        ff_subtitles_queue_clean(&sami->q);
     av_bprint_finalize(&buf, NULL);
     return res;
 }