[FFmpeg-cvslog] avformat/mxfdec: do not allow more partitions than INT_MAX/2

[Marton Balint]

ffmpeg | branch: master | Marton Balint <cus at passwd.hu> | Fri Mar  9 00:46:06 2018 +0100| [cf5ffe0183947112ac50be81942d8be610aa987c] | committer: Marton Balint

avformat/mxfdec: do not allow more partitions than INT_MAX/2

Some math (e.g: partition binary search) overflows if we have that many
parititions.

Signed-off-by: Marton Balint <cus at passwd.hu>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cf5ffe0183947112ac50be81942d8be610aa987c
---

 libavformat/mxfdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 70091e0dc9..7a42555562 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -565,6 +565,9 @@ static int mxf_read_partition_pack(void *arg, AVIOContext *pb, int tag, int size
     uint64_t footer_partition;
     uint32_t nb_essence_containers;
 
+    if (mxf->partitions_count >= INT_MAX / 2)
+        return AVERROR_INVALIDDATA;
+
     tmp_part = av_realloc_array(mxf->partitions, mxf->partitions_count + 1, sizeof(*mxf->partitions));
     if (!tmp_part)
         return AVERROR(ENOMEM);