summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--libavformat/iff.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/iff.c b/libavformat/iff.c
index e66292c785..6c52c6057b 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -501,6 +501,9 @@ static int iff_read_header(AVFormatContext *s)
case ID_DST:
case ID_MDAT:
iff->body_pos = avio_tell(pb);
+ if (iff->body_pos < 0 || iff->body_pos + data_size > INT64_MAX)
+ return AVERROR_INVALIDDATA;
+
iff->body_end = iff->body_pos + data_size;
iff->body_size = data_size;
if (chunk_id == ID_DST) {