Unified · Split
| @@ -1198,11 +1198,15 @@ static int mxf_read_essence_container_data(void *arg, AVIOContext *pb, int tag, · 1197 unmodified lines | |||
| 1198 | static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *segment) | 1198 | static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *segment) |
| 1199 | { | 1199 | { |
| 1200 | int i, length; | 1200 | int i, length; |
| 1201 | uint32_t nb_index_entries; | ||
| 1201 | 1202 | ||
| 1202 | if (segment->temporal_offset_entries) | 1203 | if (segment->temporal_offset_entries) |
| 1203 | return AVERROR_INVALIDDATA; | 1204 | return AVERROR_INVALIDDATA; |
| 1204 | 1205 | ||
| 1205 | segment->nb_index_entries = avio_rb32(pb); | 1206 | nb_index_entries = avio_rb32(pb); |
| 1207 | if (nb_index_entries > INT_MAX) | ||
| 1208 | return AVERROR_INVALIDDATA; | ||
| 1209 | segment->nb_index_entries = nb_index_entries; | ||
| 1206 | 1210 | ||
| 1207 | length = avio_rb32(pb); | 1211 | length = avio_rb32(pb); |
| 1208 | if(segment->nb_index_entries && length < 11) | 1212 | if(segment->nb_index_entries && length < 11) |