diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2024-07-08 19:12:26 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2024-07-08 20:11:20 +0200 |
| commit | 9ffac78eba3887f2d7c113937162607d05180e0c (patch) | |
| tree | a1a4c3b87c04938567ee10e67796efeb7fcd7007 | |
| parent | 8765b36a526ba1e9698e060f9bcd646f3dfeeaf4 (diff) | |
| download | ffmpeg-9ffac78eba3887f2d7c113937162607d05180e0c.tar.gz | |
avformat/matroskaenc: Fix and simplify check for invalid crop values
The check "left >= INT_MAX - right" is supposed to check for
whether left + right does not overflow/wraparound, but given that
left and top are uint32_t INT_MAX - right can already wraparound
for big values of right (and ordinary 32-bit ints):
If right == UINT32_MAX, INT_MAX - right is INT_MAX + 1;
for left in 0..par->width both checks will be passed.
Fix this and simplify the check by using 64-bit types,
where the addition is guaranteed not to overflow.
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
| -rw-r--r-- | libavformat/matroskaenc.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/libavformat/matroskaenc.c b/libavformat/matroskaenc.c index e1adc0eba6..4b91283119 100644 --- a/libavformat/matroskaenc.c +++ b/libavformat/matroskaenc.c @@ -1786,16 +1786,14 @@ static int mkv_write_track_video(AVFormatContext *s, MatroskaMuxContext *mkv, st->codecpar->nb_coded_side_data, AV_PKT_DATA_FRAME_CROPPING); if (sd && sd->size == sizeof(uint32_t) * 4) { - uint32_t top, bottom, left, right; + uint64_t top, bottom, left, right; top = AV_RL32(sd->data + 0); bottom = AV_RL32(sd->data + 4); left = AV_RL32(sd->data + 8); right = AV_RL32(sd->data + 12); - if (left >= INT_MAX - right || - top >= INT_MAX - bottom || - (left + right) >= par->width || + if ((left + right) >= par->width || (top + bottom) >= par->height) { av_log(s, AV_LOG_ERROR, "Invalid cropping dimensions in stream side data\n"); return AVERROR(EINVAL); |