]> git.sesse.net Git - ffmpeg/commitdiff
hqx: correct type and size check of info_offset
authorAndreas Cadhalpun <andreas.cadhalpun@gmail.com>
Sun, 15 Nov 2015 09:50:44 +0000 (10:50 +0100)
committerVittorio Giovara <vittorio.giovara@gmail.com>
Mon, 16 Nov 2015 11:56:03 +0000 (12:56 +0100)
It is used as size argument of ff_canopus_parse_info_tag, which uses it
as size argument to bytestream2_init, which only supports sizes up to
INT_MAX.
Changing it's type to unsigned simplifies the check.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
libavcodec/hqx.c

index 34e36056c76162407f13a84b890bb2145eff3789..7411d3f2523a78fb18ef3d778454742213034e40 100644 (file)
@@ -417,8 +417,8 @@ static int hqx_decode_frame(AVCodecContext *avctx, void *data,
 
     info_tag    = AV_RL32(src);
     if (info_tag == MKTAG('I', 'N', 'F', 'O')) {
-        int info_offset = AV_RL32(src + 4);
-        if (info_offset > UINT32_MAX - 8 || info_offset + 8 > avpkt->size) {
+        unsigned info_offset = AV_RL32(src + 4);
+        if (info_offset > INT_MAX || info_offset + 8 > avpkt->size) {
             av_log(avctx, AV_LOG_ERROR,
                    "Invalid INFO header offset: 0x%08"PRIX32" is too large.\n",
                    info_offset);