diff --git a/libavformat/apetag.c b/libavformat/apetag.c index 2390bfaad3..41ba054d69 100644 --- a/libavformat/apetag.c +++ b/libavformat/apetag.c @@ -51,8 +51,10 @@ static int ape_tag_read_field(AVFormatContext *s) av_log(s, AV_LOG_WARNING, "Invalid APE tag key '%s'.\n", key); return -1; } - if (size >= UINT_MAX) - return -1; + if (size > INT32_MAX - FF_INPUT_BUFFER_PADDING_SIZE) { + av_log(s, AV_LOG_ERROR, "APE tag size too large.\n"); + return AVERROR_INVALIDDATA; + } value = av_malloc(size+1); if (!value) return AVERROR(ENOMEM);