[FFmpeg-cvslog] avformat/cdxl: Fix integer overflow of image_size

[Michael Niedermayer]

ffmpeg | branch: release/2.1 | Michael Niedermayer <michaelni at gmx.at> | Wed Dec 31 21:41:46 2014 +0100| [41802887eb647bee21238e0a575a7c4bbf954b86] | committer: Michael Niedermayer

avformat/cdxl: Fix integer overflow of image_size

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 3eb5cbe0c50d0a0bbe10bcabbd6b16d73d93c128)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=41802887eb647bee21238e0a575a7c4bbf954b86
---

 libavformat/cdxl.c |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/cdxl.c b/libavformat/cdxl.c
index ab8a846..51b9567 100644
--- a/libavformat/cdxl.c
+++ b/libavformat/cdxl.c
@@ -127,6 +127,8 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt)
     height       = AV_RB16(&cdxl->header[16]);
     palette_size = AV_RB16(&cdxl->header[20]);
     audio_size   = AV_RB16(&cdxl->header[22]);
+    if (FFALIGN(width, 16) * (uint64_t)height * cdxl->header[19] > INT_MAX)
+        return AVERROR_INVALIDDATA;
     image_size   = FFALIGN(width, 16) * height * cdxl->header[19] / 8;
     video_size   = palette_size + image_size;