diff --git a/libavformat/ape.c b/libavformat/ape.c index a7be29a469..7ced92cf76 100644 --- a/libavformat/ape.c +++ b/libavformat/ape.c @@ -301,6 +301,8 @@ static int ape_read_header(AVFormatContext * s) ape->frames[i].pos -= ape->frames[i].skip; ape->frames[i].size += ape->frames[i].skip; } + if (ape->frames[i].size > INT_MAX - 3) + return AVERROR_INVALIDDATA; ape->frames[i].size = (ape->frames[i].size + 3) & ~3; } if (ape->fileversion < 3810) {