From 295218f531528d18f0f21937d3ddf28318898a7c Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Mon, 15 Oct 2012 15:48:13 +0000
Subject: [PATCH] idcin: check chunk_size value before using it
Fixes integer overflow. Fixes CID732223.
Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
libavformat/idcin.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/idcin.c b/libavformat/idcin.c
index f1df00244fc..bede04075e0 100644
--- a/libavformat/idcin.c
+++ b/libavformat/idcin.c
@@ -256,6 +256,8 @@ static int idcin_read_packet(AVFormatContext *s,
chunk_size = avio_rl32(pb);
/* skip the number of decoded bytes (always equal to width * height) */
avio_skip(pb, 4);
+ if (chunk_size < 4)
+ return AVERROR_INVALIDDATA;
chunk_size -= 4;
ret= av_get_packet(pb, pkt, chunk_size);
if (ret < 0)
--
GitLab