ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-09-20 05:16:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/mov: Fix integer overflows related to sample_duration

Browse Source 
Fixes: runtime error: signed integer overflow: -9166684017437101870 + -2495066639299164439 cannot be represented in type

Fixes: Chromium bug 791349

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f37082827)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-03-09 16:43:29 +01:00
parent 3a29fda42a
commit edfe9ae63b
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libavformat/mov.c
View File

@ -2672,14 +2672,19 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
&& total_sample_count > 100 && total_sample_count > 100
&& sample_duration/10 > duration / total_sample_count) && sample_duration/10 > duration / total_sample_count)
sample_duration = duration / total_sample_count; sample_duration = duration / total_sample_count;
duration+=(int64_t)sample_duration*sample_count; duration+=(int64_t)sample_duration*(uint64_t)sample_count;
total_sample_count+=sample_count; total_sample_count+=sample_count;
} }
sc->stts_count = i; sc->stts_count = i;
sc->duration_for_fps += duration; if (duration > 0 &&
sc->nb_frames_for_fps += total_sample_count; duration <= INT64_MAX - sc->duration_for_fps &&
total_sample_count <= INT64_MAX - sc->nb_frames_for_fps
) {
sc->duration_for_fps += duration;
sc->nb_frames_for_fps += total_sample_count;
}
if (pb->eof_reached) if (pb->eof_reached)
return AVERROR_EOF; return AVERROR_EOF;
@ -4340,8 +4345,13 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
dts += sample_duration; dts += sample_duration;
offset += sample_size; offset += sample_size;
sc->data_size += sample_size; sc->data_size += sample_size;
sc->duration_for_fps += sample_duration;
sc->nb_frames_for_fps ++; if (sample_duration <= INT64_MAX - sc->duration_for_fps &&
1 <= INT64_MAX - sc->nb_frames_for_fps
) {
sc->duration_for_fps += sample_duration;
sc->nb_frames_for_fps ++;
}
} }
if (pb->eof_reached) if (pb->eof_reached)