X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fvoc_packet.c;h=e5ae0be1deddba3c3c133c970d3dfbd5b2c1dcb5;hb=11cb635c84cd5d011abc2aade27c7498bcf29595;hp=1e2e19e1c36b97b34b032e74f7c76348d21bacbe;hpb=ebdc5c419aef0d9eed8c1ec57b30238194c1db0a;p=ffmpeg

diff --git a/libavformat/voc_packet.c b/libavformat/voc_packet.c
index 1e2e19e1c36..e5ae0be1ded 100644
--- a/libavformat/voc_packet.c
+++ b/libavformat/voc_packet.c
@@ -44,19 +44,29 @@ ff_voc_get_packet(AVFormatContext *s, AVPacket *pkt, AVStream *st, int max_size)
                        AVINDEX_KEYFRAME);
 
     while (!voc->remaining_size) {
+        if (max_size < 4)
+            max_size = 0;
         type = avio_r8(pb);
         if (type == VOC_TYPE_EOF)
             return AVERROR_EOF;
         voc->remaining_size = avio_rl24(pb);
         if (!voc->remaining_size) {
+            int64_t filesize;
             if (!(s->pb->seekable & AVIO_SEEKABLE_NORMAL))
                 return AVERROR(EIO);
-            voc->remaining_size = avio_size(pb) - avio_tell(pb);
+            filesize = avio_size(pb);
+            if (filesize - avio_tell(pb) > INT_MAX)
+                return AVERROR_INVALIDDATA;
+            voc->remaining_size = filesize - avio_tell(pb);
         }
         max_size -= 4;
 
         switch (type) {
         case VOC_TYPE_VOICE_DATA:
+            if (voc->remaining_size < 2) {
+                voc->remaining_size = 0;
+                return AVERROR_INVALIDDATA;
+            }
             if (!par->sample_rate) {
                 par->sample_rate = 1000000 / (256 - avio_r8(pb));
                 if (sample_rate)
@@ -85,6 +95,10 @@ ff_voc_get_packet(AVFormatContext *s, AVPacket *pkt, AVStream *st, int max_size)
             break;
 
         case VOC_TYPE_NEW_VOICE_DATA:
+            if (voc->remaining_size < 12) {
+                voc->remaining_size = 0;
+                return AVERROR_INVALIDDATA;
+            }
             if (!par->sample_rate) {
                 par->sample_rate = avio_rl32(pb);
                 avpriv_set_pts_info(st, 64, 1, par->sample_rate);