From 32631852259a8aeb845c39ed7fa707c6e102c40a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 6 Nov 2022 11:26:51 +0100
Subject: avcodec/bonk: Check step against overflow

No testcase

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/bonk.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/bonk.c b/libavcodec/bonk.c
index d2571e56d4..b56a940681 100644
--- a/libavcodec/bonk.c
+++ b/libavcodec/bonk.c
@@ -180,6 +180,8 @@ static int intlist_read(BonkContext *s, int *buf, int entries, int base_2_part)
             if (!dominant)
                 n_zeros += steplet;
 
+            if (step > INT32_MAX*8LL/9 + 1)
+                return AVERROR_INVALIDDATA;
             step += step / 8;
         } else if (steplet > 0) {
             int actual_run = read_uint_max(s, steplet - 1);
-- 
cgit v1.2.3