avformat/evcdec: use an unsigned type for nalu_size

But ensure the value returned by evc_read_nal_unit_length() fits in an int. Should prevent integer overflows later in the code.

James Almer committed 3 years ago

Commit d0d20f11 parent a6a5e531 file · +2 −2Browse files

Unified · Split

@@ -181,7 +181,7 @@ fail: · 180 unmodified lines
181	181	static int evc_read_packet(AVFormatContext s, AVPacket pkt)
182	182	{
183	183	int ret;
184		− int32_t nalu_size;
	184	+ uint32_t nalu_size;
185	185	int au_end_found = 0;
186	186	EVCDemuxContext *const c = s->priv_data;
187	187
@@ -200,7 +200,7 @@ static int evc_read_packet(AVFormatContext s, AVPacket pkt) · 12 unmodified lines
200	200	return ret;
201	201
202	202	nalu_size = read_nal_unit_length((const uint8_t *)&buf, EVC_NALU_LENGTH_PREFIX_SIZE);
203		− if (nalu_size <= 0)
	203	+ if (!nalu_size \|\| nalu_size > INT_MAX)
204	204	return AVERROR_INVALIDDATA;
205	205
206	206	avio_seek(s->pb, -EVC_NALU_LENGTH_PREFIX_SIZE, SEEK_CUR);

Keyboard shortcuts