Prevent potential integer overflows.
Unified · Split
| @@ -1421,9 +1421,10 @@ static int parse_speex_extradata(AVCodecContext *avctx, · 1420 unmodified lines | |||
| 1421 | return AVERROR_INVALIDDATA; | 1421 | return AVERROR_INVALIDDATA; |
| 1422 | s->bitrate = bytestream_get_le32(&buf); | 1422 | s->bitrate = bytestream_get_le32(&buf); |
| 1423 | s->frame_size = bytestream_get_le32(&buf); | 1423 | s->frame_size = bytestream_get_le32(&buf); |
| 1424 | if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0)) | 1424 | if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0) || |
| 1425 | s->frame_size > INT32_MAX >> (s->mode > 0)) | ||
| 1425 | return AVERROR_INVALIDDATA; | 1426 | return AVERROR_INVALIDDATA; |
| 1426 | s->frame_size *= 1 + (s->mode > 0); | 1427 | s->frame_size <<= (s->mode > 0); |
| 1427 | s->vbr = bytestream_get_le32(&buf); | 1428 | s->vbr = bytestream_get_le32(&buf); |
| 1428 | s->frames_per_packet = bytestream_get_le32(&buf); | 1429 | s->frames_per_packet = bytestream_get_le32(&buf); |
| 1429 | if (s->frames_per_packet <= 0 || | 1430 | if (s->frames_per_packet <= 0 || |