From 3eb5cbe0c50d0a0bbe10bcabbd6b16d73d93c128 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Wed, 31 Dec 2014 21:41:46 +0100
Subject: [PATCH] avformat/cdxl: Fix integer overflow of image_size
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
libavformat/cdxl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavformat/cdxl.c b/libavformat/cdxl.c
index 5bdf44bcd11..f198bf50fa4 100644
--- a/libavformat/cdxl.c
+++ b/libavformat/cdxl.c
@@ -130,6 +130,8 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt)
height = AV_RB16(&cdxl->header[16]);
palette_size = AV_RB16(&cdxl->header[20]);
audio_size = AV_RB16(&cdxl->header[22]);
+ if (FFALIGN(width, 16) * (uint64_t)height * cdxl->header[19] > INT_MAX)
+ return AVERROR_INVALIDDATA;
image_size = FFALIGN(width, 16) * height * cdxl->header[19] / 8;
video_size = palette_size + image_size;
--
GitLab