avformat/evcdec: use an unsigned type for nalu_size

But ensure the value returned by evc_read_nal_unit_length() fits in an int. Should prevent integer overflows later in the code.

James Almer committed 3 years ago

Commit d0d20f11 parent a6a5e531 file · +2 −2Browse files

Showing the changes to libavformat (1 of 1 file). Show all

Unified · Split

@@ -181,7 +181,7 @@ fail: · 180 unmodified lines
181	static int evc_read_packet(AVFormatContext s, AVPacket pkt)	181	static int evc_read_packet(AVFormatContext s, AVPacket pkt)
182	{	182	{
183	int ret;	183	int ret;
184	int32_t nalu_size;	184	uint32_t nalu_size;
185	int au_end_found = 0;	185	int au_end_found = 0;
186	EVCDemuxContext *const c = s->priv_data;	186	EVCDemuxContext *const c = s->priv_data;
187		187
@@ -200,7 +200,7 @@ static int evc_read_packet(AVFormatContext s, AVPacket pkt) · 12 unmodified lines
200	return ret;	200	return ret;
201		201
202	nalu_size = read_nal_unit_length((const uint8_t *)&buf, EVC_NALU_LENGTH_PREFIX_SIZE);	202	nalu_size = read_nal_unit_length((const uint8_t *)&buf, EVC_NALU_LENGTH_PREFIX_SIZE);
203	if (nalu_size <= 0)	203	if (!nalu_size \|\| nalu_size > INT_MAX)
204	return AVERROR_INVALIDDATA;	204	return AVERROR_INVALIDDATA;
205		205
206	avio_seek(s->pb, -EVC_NALU_LENGTH_PREFIX_SIZE, SEEK_CUR);	206	avio_seek(s->pb, -EVC_NALU_LENGTH_PREFIX_SIZE, SEEK_CUR);

Keyboard shortcuts