dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-13 17:07:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/oggparsevorbis.c: Prevent integer overflow when summing header lengths; add bounds check.

Browse Source 
Cherry-picked from 6e0e13b0bf

Signed-off-by: Romain Beauxis <romain.beauxis@gmail.com>
This commit is contained in:
Romain Beauxis
2026-05-21 20:55:41 +00:00
committed by Romain Beauxis
parent 9c97844724
commit 5cff5a3a5a
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libavformat/oggparsevorbis.c
View File

@@ -223,8 +223,11 @@ static int fixup_vorbis_headers(AVFormatContext *as,
int i, offset, len, err;
int buf_len;
unsigned char *ptr;
uint64_t total_len = (uint64_t)priv->len[0] + priv->len[1] + priv->len[2];
if (total_len + total_len / 255 + 64 > INT_MAX)
return AVERROR_INVALIDDATA;
len = priv->len[0] + priv->len[1] + priv->len[2];
len = total_len;
buf_len = len + len / 255 + 64;
if (*buf)