Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/utils.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/libavcodec/utils.c b/libavcodec/utils.c index cde5849a41..feee7556ac 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -2278,6 +2278,9 @@ void avcodec_parameters_free(AVCodecParameters **ppar) int avcodec_parameters_copy(AVCodecParameters *dst, const AVCodecParameters *src) { + if (src->extradata_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) + return AVERROR(EINVAL); + codec_parameters_reset(dst); memcpy(dst, src, sizeof(*dst)); @@ -2341,6 +2344,8 @@ int avcodec_parameters_from_context(AVCodecParameters *par, } if (codec->extradata) { + if (codec->extradata_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) + return AVERROR(EINVAL); par->extradata = av_mallocz(codec->extradata_size + AV_INPUT_BUFFER_PADDING_SIZE); if (!par->extradata) return AVERROR(ENOMEM); @@ -2397,6 +2402,8 @@ int avcodec_parameters_to_context(AVCodecContext *codec, } if (par->extradata) { + if (par->extradata_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) + return AVERROR(EINVAL); av_freep(&codec->extradata); codec->extradata = av_mallocz(par->extradata_size + AV_INPUT_BUFFER_PADDING_SIZE); if (!codec->extradata) -- 2.13.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-devel