diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-03-05 23:12:57 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-06-18 01:16:03 +0200 |
| commit | 7a713cea22f477be3dfc4ab740f805e5b8ed02c0 (patch) | |
| tree | 1828c2eac4a40dd3237ae122d5cb4693edae2ce8 | |
| parent | 8456bba36297cf743d388debb610e0ee864e18b8 (diff) | |
| download | ffmpeg-7a713cea22f477be3dfc4ab740f805e5b8ed02c0.tar.gz | |
avformat/mov: Fix integer overflow in mov_get_stsc_samples()
Fixes: runtime error: signed integer overflow: 5 * -2147483647 cannot be represented in type 'int'
Fixes: Chromium bug 817338
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Reported-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 367929bed9def1ccdd9a0f4ac5b7b98d1993782d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/mov.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 9a6c3b3e46..f91a006639 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2457,7 +2457,7 @@ static inline int mov_stsc_index_valid(unsigned int index, unsigned int count) } /* Compute the samples value for the stsc entry at the given index. */ -static inline int mov_get_stsc_samples(MOVStreamContext *sc, unsigned int index) +static inline int64_t mov_get_stsc_samples(MOVStreamContext *sc, unsigned int index) { int chunk_count; @@ -2466,7 +2466,7 @@ static inline int mov_get_stsc_samples(MOVStreamContext *sc, unsigned int index) else chunk_count = sc->chunk_count - (sc->stsc_data[index].first - 1); - return sc->stsc_data[index].count * chunk_count; + return sc->stsc_data[index].count * (int64_t)chunk_count; } static int mov_read_stps(MOVContext *c, AVIOContext *pb, MOVAtom atom) @@ -6708,12 +6708,13 @@ static int mov_seek_stream(AVFormatContext *s, AVStream *st, int64_t timestamp, /* adjust stsd index */ time_sample = 0; for (i = 0; i < sc->stsc_count; i++) { - int next = time_sample + mov_get_stsc_samples(sc, i); + int64_t next = time_sample + mov_get_stsc_samples(sc, i); if (next > sc->current_sample) { sc->stsc_index = i; sc->stsc_sample = sc->current_sample - time_sample; break; } + av_assert0(next == (int)next); time_sample = next; } |