diff --git a/libavformat/concat.c b/libavformat/concat.c index 92efc61185..f15cee2ff4 100644 --- a/libavformat/concat.c +++ b/libavformat/concat.c @@ -114,6 +114,12 @@ static av_cold int concat_open(URLContext *h, const char *uri, int flags) break; } + if (total_size > INT64_MAX - size) { + ffurl_close(uc); + err = AVERROR_INVALIDDATA; + break; + } + /* assembling */ nodes[i].uc = uc; nodes[i].size = size; @@ -284,6 +290,12 @@ static av_cold int concatf_open(URLContext *h, const char *uri, int flags) break; } + if (total_size > INT64_MAX - size) { + ffurl_close(uc); + err = AVERROR_INVALIDDATA; + break; + } + nodes = av_fast_realloc(data->nodes, &nodes_size, sizeof(*nodes) * len); if (!nodes) { ffurl_close(uc);