[FFmpeg-devel] [PATCH] avformat/mxfdec: Check that edit_unit_byte_count is not negative

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavformat/mxfdec.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index e484db052ef..37446963369 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1245,9 +1245,13 @@ static int mxf_read_index_entry_array(AVIOContext *pb, MXFIndexTableSegment *seg
 static int mxf_read_index_table_segment(void *arg, AVIOContext *pb, int tag, int size, UID uid, int64_t klv_offset)
 {
     MXFIndexTableSegment *segment = arg;
+    int tmp;
     switch(tag) {
     case 0x3F05:
-        segment->edit_unit_byte_count = avio_rb32(pb);
+        tmp = avio_rb32(pb);
+        if (tmp < 0)
+            return AVERROR_INVALIDDATA;
+        segment->edit_unit_byte_count = tmp;
         av_log(NULL, AV_LOG_TRACE, "EditUnitByteCount %d\n", segment->edit_unit_byte_count);
         break;
     case 0x3F06:
-- 
2.17.1