avcodec/exr: fix skipping too long metadata values

sandflow · Sep 22, 2022 · f55f817 · f55f817
1 parent c9aa616
commit f55f817
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
@@ -1962,7 +1962,7 @@ static int decode_header(EXRContext *s, AVFrame *frame)
         {
             uint8_t name[256] = { 0 };
             uint8_t type[256] = { 0 };
-            uint8_t value[256] = { 0 };
+            uint8_t value[8192] = { 0 };
             int i = 0, size;
 
             while (bytestream2_get_bytes_left(gb) > 0 &&
@@ -1980,6 +1980,8 @@ static int decode_header(EXRContext *s, AVFrame *frame)
             size = bytestream2_get_le32(gb);
 
             bytestream2_get_buffer(gb, value, FFMIN(sizeof(value) - 1, size));
+            if (size > sizeof(value) - 1)
+                bytestream2_skip(gb, size - (sizeof(value) - 1));
             if (!strcmp(type, "string"))
                 av_dict_set(&metadata, name, value, 0);
         }