diff --git a/libavformat/cdxl.c b/libavformat/cdxl.c index 5bdf44bcd110afa579b279d943e5f46e95c4da0a..f198bf50fa461b07175a6d863ed0d27a26991663 100644 --- a/libavformat/cdxl.c +++ b/libavformat/cdxl.c @@ -130,6 +130,8 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt) height = AV_RB16(&cdxl->header[16]); palette_size = AV_RB16(&cdxl->header[20]); audio_size = AV_RB16(&cdxl->header[22]); + if (FFALIGN(width, 16) * (uint64_t)height * cdxl->header[19] > INT_MAX) + return AVERROR_INVALIDDATA; image_size = FFALIGN(width, 16) * height * cdxl->header[19] / 8; video_size = palette_size + image_size;