From da3c3c446cb434be9d0025f519e00c2385135c85 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Tue, 5 Jan 2016 13:01:53 +0100 Subject: [PATCH] avpacket: fix size check in packet_alloc The previous check only caught sizes from -AV_INPUT_BUFFER_PADDING_SIZE to -1. This fixes ubsan runtime error: signed integer overflow: 2147483647 + 32 cannot be represented in type 'int' Reviewed-by: Michael Niedermayer Signed-off-by: Andreas Cadhalpun --- libavcodec/avpacket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/avpacket.c b/libavcodec/avpacket.c index 97c12b57fb..4901d361b1 100644 --- a/libavcodec/avpacket.c +++ b/libavcodec/avpacket.c @@ -71,7 +71,7 @@ void av_packet_free(AVPacket **pkt) static int packet_alloc(AVBufferRef **buf, int size) { int ret; - if ((unsigned)size >= (unsigned)size + AV_INPUT_BUFFER_PADDING_SIZE) + if (size < 0 || size >= INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) return AVERROR(EINVAL); ret = av_buffer_realloc(buf, size + AV_INPUT_BUFFER_PADDING_SIZE);