diff --git a/libavformat/flacdec.c b/libavformat/flacdec.c index 12d4b7305f..1f5cfeed71 100644 --- a/libavformat/flacdec.c +++ b/libavformat/flacdec.c @@ -42,12 +42,16 @@ typedef struct FLACDecContext { AVCodecContext *parser_dec; } FLACDecContext; -static void reset_index_position(int64_t metadata_head_size, AVStream *st) +static int reset_index_position(int64_t metadata_head_size, AVStream *st) { FFStream *const sti = ffstream(st); /* the real seek index offset should be the size of metadata blocks with the offset in the frame blocks */ - for (int i = 0; i < sti->nb_index_entries; i++) + for (int i = 0; i < sti->nb_index_entries; i++) { + if (0x7FFFFFFFFFFFFFFF - metadata_head_size < sti->index_entries[i].pos) + return AVERROR_INVALIDDATA; sti->index_entries[i].pos += metadata_head_size; + } + return 0; } static const uint16_t sr_table[16] = { @@ -225,7 +229,8 @@ static int flac_read_header(AVFormatContext *s) if (ret < 0) return ret; - reset_index_position(avio_tell(s->pb), st); + if (ret = reset_index_position(avio_tell(s->pb), st)) + return ret; return 0; fail: