File tree 1 file changed +5
-2
lines changed
1 file changed +5
-2
lines changed Original file line number Diff line number Diff line change @@ -1884,8 +1884,8 @@ avi_t *AVI_open_fd(FILE *fd, int getIndex)
18841884
18851885int avi_parse_input_file (avi_t * AVI , int getIndex )
18861886{
1887- int i , rate , scale , idx_type ;
1888- s64 n ;
1887+ int rate , scale , idx_type ;
1888+ s64 n , i ;
18891889 unsigned char * hdrl_data ;
18901890 u64 header_offset = 0 ;
18911891 int hdrl_len = 0 ;
@@ -1939,6 +1939,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
19391939 n -= 4 ;
19401940 if (strnicmp (data ,"hdrl" ,4 ) == 0 )
19411941 {
1942+ if (n > 0xFFFFFFFF ) ERR_EXIT (AVI_ERR_READ )
19421943 hdrl_len = (u32 ) n ;
19431944 hdrl_data = (unsigned char * ) gf_malloc ((u32 )n );
19441945 if (hdrl_data == 0 ) ERR_EXIT (AVI_ERR_NO_MEM );
@@ -2091,8 +2092,10 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
20912092 AVI -> compressor2 [4 ] = 0 ;
20922093
20932094 if (n > 40 ) {
2095+ if (n > 0xFFFFFFFF ) ERR_EXIT (AVI_ERR_READ )
20942096 AVI -> extradata_size = (u32 ) (n - 40 );
20952097 AVI -> extradata = gf_malloc (sizeof (u8 )* AVI -> extradata_size );
2098+ if (!AVI -> extradata ) ERR_EXIT (AVI_ERR_NO_MEM )
20962099 memcpy (AVI -> extradata , hdrl_data + i + 40 , AVI -> extradata_size );
20972100 }
20982101
You can’t perform that action at this time.
0 commit comments