Check size_bmp more fully
This commit is contained in:
@@ -695,7 +695,8 @@ static int parse_video_info(AVIOContext *pb, AVStream *st)
|
|||||||
st->codec->codec_tag = tag;
|
st->codec->codec_tag = tag;
|
||||||
st->codec->codec_id = ff_codec_get_id(ff_codec_bmp_tags, tag);
|
st->codec->codec_id = ff_codec_get_id(ff_codec_bmp_tags, tag);
|
||||||
|
|
||||||
if (size > BMP_HEADER_SIZE) {
|
if (size > BMP_HEADER_SIZE &&
|
||||||
|
size < INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {
|
||||||
int ret;
|
int ret;
|
||||||
st->codec->extradata_size = size - BMP_HEADER_SIZE;
|
st->codec->extradata_size = size - BMP_HEADER_SIZE;
|
||||||
if (!(st->codec->extradata = av_malloc(st->codec->extradata_size +
|
if (!(st->codec->extradata = av_malloc(st->codec->extradata_size +
|
||||||
|
|||||||
Reference in New Issue
Block a user