[FFmpeg-devel] [PATCH] avformat/mxfdec: Check that edit_unit_byte_count is not negative

[Marton Balint]

On Mon, 1 Apr 2024, Michael Niedermayer wrote:

> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
> libavformat/mxfdec.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> index e484db052ef..37446963369 100644
> --- a/libavformat/mxfdec.c
> +++ b/libavformat/mxfdec.c
> @@ -1245,9 +1245,13 @@ static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *seg
> static int mxf_read_index_table_segment(void *arg, AVIOContext *pb, int tag, int size, UID uid, int64_t klv_offset)
> {
>     MXFIndexTableSegment *segment = arg;
> +    int tmp;
>     switch(tag) {
>     case 0x3F05:
> -        segment->edit_unit_byte_count = avio_rb32(pb);

Why not simply make segment->edit_unit_byte_count unsigned?

Thanks,
Marton


> +        tmp = avio_rb32(pb);
> +        if (tmp < 0)
> +            return AVERROR_INVALIDDATA;
> +        segment->edit_unit_byte_count = tmp;
>         av_log(NULL, AV_LOG_TRACE, "EditUnitByteCount %d\n", segment->edit_unit_byte_count);
>         break;
>     case 0x3F06:
> -- 
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>