Unified · Split
| @@ -1198,11 +1198,15 @@ static int mxf_read_essence_container_data(void *arg, AVIOContext *pb, int tag, · 1197 unmodified lines | ||
| 1198 | 1198 | static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *segment) |
| 1199 | 1199 | { |
| 1200 | 1200 | int i, length; |
| 1201 | + uint32_t nb_index_entries; | |
| 1201 | 1202 | |
| 1202 | 1203 | if (segment->temporal_offset_entries) |
| 1203 | 1204 | return AVERROR_INVALIDDATA; |
| 1204 | 1205 | |
| 1205 | − segment->nb_index_entries = avio_rb32(pb); | |
| 1206 | + nb_index_entries = avio_rb32(pb); | |
| 1207 | + if (nb_index_entries > INT_MAX) | |
| 1208 | + return AVERROR_INVALIDDATA; | |
| 1209 | + segment->nb_index_entries = nb_index_entries; | |
| 1206 | 1210 | |
| 1207 | 1211 | length = avio_rb32(pb); |
| 1208 | 1212 | if(segment->nb_index_entries && length < 11) |