Skip to content

Commit 7f060bb

Browse files
committed
fixed #2159
1 parent bf7e583 commit 7f060bb

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

Diff for: src/media_tools/avilib.c

+5-2
Original file line numberDiff line numberDiff line change
@@ -1884,8 +1884,8 @@ avi_t *AVI_open_fd(FILE *fd, int getIndex)
18841884

18851885
int avi_parse_input_file(avi_t *AVI, int getIndex)
18861886
{
1887-
int i, rate, scale, idx_type;
1888-
s64 n;
1887+
int rate, scale, idx_type;
1888+
s64 n, i;
18891889
unsigned char *hdrl_data;
18901890
u64 header_offset=0;
18911891
int hdrl_len=0;
@@ -1939,6 +1939,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
19391939
n -= 4;
19401940
if(strnicmp(data,"hdrl",4) == 0)
19411941
{
1942+
if (n>0xFFFFFFFF) ERR_EXIT(AVI_ERR_READ)
19421943
hdrl_len = (u32) n;
19431944
hdrl_data = (unsigned char *) gf_malloc((u32)n);
19441945
if(hdrl_data==0) ERR_EXIT(AVI_ERR_NO_MEM);
@@ -2091,8 +2092,10 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
20912092
AVI->compressor2[4] = 0;
20922093

20932094
if (n>40) {
2095+
if (n>0xFFFFFFFF) ERR_EXIT(AVI_ERR_READ)
20942096
AVI->extradata_size = (u32) (n - 40);
20952097
AVI->extradata = gf_malloc(sizeof(u8)* AVI->extradata_size);
2098+
if (!AVI->extradata) ERR_EXIT(AVI_ERR_NO_MEM)
20962099
memcpy(AVI->extradata, hdrl_data + i + 40, AVI->extradata_size);
20972100
}
20982101

0 commit comments

Comments
 (0)