diff --git a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c index 64cc6be60b..01d754c3eb 100644 --- a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c +++ b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c @@ -3933,7 +3933,8 @@ gst_matroska_demux_add_wvpk_header (GstElement * element, } else { guint8 *outdata = NULL; gsize buf_size, size; - guint32 block_samples, flags, crc, blocksize; + guint32 block_samples, flags, crc; + gsize blocksize; GstAdapter *adapter; adapter = gst_adapter_new (); @@ -3974,6 +3975,13 @@ gst_matroska_demux_add_wvpk_header (GstElement * element, return GST_FLOW_ERROR; } + if (blocksize > G_MAXSIZE - WAVPACK4_HEADER_SIZE) { + GST_ERROR_OBJECT (element, "Too big wavpack buffer"); + gst_buffer_unmap (*buf, &map); + g_object_unref (adapter); + return GST_FLOW_ERROR; + } + g_assert (newbuf == NULL); newbuf =