|
@@ -453,9 +453,13 @@ static int parse_keyframes_index(AVFormatContext *s, AVIOContext *ioc, int64_t m
|
|
|
}
|
|
|
|
|
|
for (i = 0; i < arraylen && avio_tell(ioc) < max_pos - 1; i++) {
|
|
|
+ double d;
|
|
|
if (avio_r8(ioc) != AMF_DATA_TYPE_NUMBER)
|
|
|
goto invalid;
|
|
|
- current_array[0][i] = av_int2double(avio_rb64(ioc));
|
|
|
+ d = av_int2double(avio_rb64(ioc));
|
|
|
+ if (isnan(d) || d < INT64_MIN || d > INT64_MAX)
|
|
|
+ goto invalid;
|
|
|
+ current_array[0][i] = d;
|
|
|
}
|
|
|
if (times && filepositions) {
|
|
|
// All done, exiting at a position allowing amf_parse_object
|