avformat/iamf_parse.c: Fix potential integer overflow in opus_decoder_config()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 016a241102)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2026-05-03 04:03:07 +02:00
parent d1b0069077
commit d26ce3ec60
No known key found for this signature in database
GPG key ID: B18E8928B3948D64

View file

@ -38,7 +38,7 @@ static int opus_decoder_config(IAMFCodecConfig *codec_config,
{
int ret, left = len - avio_tell(pb);
if (left < 11 || codec_config->audio_roll_distance >= 0)
if (left < 11 || codec_config->audio_roll_distance >= 0 || left > INT_MAX - 8)
return AVERROR_INVALIDDATA;
codec_config->extradata = av_malloc(left + 8);