diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-12-04 13:17:30 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-12-04 13:37:04 +0100 |
| commit | 9d44e236187c9cfefb0602149c631f18b9303c21 (patch) | |
| tree | cf865a4a09c0c9233ed461a3bc12083a82dd5651 /ffmpeg.c | |
| parent | 18268f761bffb37552f59f87542fef3d5c80618c (diff) | |
| download | ffmpeg-9d44e236187c9cfefb0602149c631f18b9303c21.tar.gz | |
ffmpeg: Check pkt_dts for AV_NOPTS_VALUE
Fixes integer overflow
Fixes: 1536b9b096a8f95b742bae9d3d761cc6/signal_sigsegv_294aaed_2039_8d1797aeb823ea43858d0fa45c9eb899.ogv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'ffmpeg.c')
| -rw-r--r-- | ffmpeg.c | 9 |
1 files changed, 5 insertions, 4 deletions
@@ -3733,6 +3733,7 @@ static int process_input(int file_index) AVPacket pkt; int ret, i, j; int64_t duration; + int64_t pkt_dts; is = ifile->ctx; ret = get_input_packet(ifile, &pkt); @@ -3879,11 +3880,11 @@ static int process_input(int file_index) if (pkt.dts != AV_NOPTS_VALUE) pkt.dts *= ist->ts_scale; + pkt_dts = av_rescale_q_rnd(pkt.dts, ist->st->time_base, AV_TIME_BASE_Q, AV_ROUND_NEAR_INF|AV_ROUND_PASS_MINMAX); if ((ist->dec_ctx->codec_type == AVMEDIA_TYPE_VIDEO || ist->dec_ctx->codec_type == AVMEDIA_TYPE_AUDIO) && - pkt.dts != AV_NOPTS_VALUE && ist->next_dts == AV_NOPTS_VALUE && !copy_ts + pkt_dts != AV_NOPTS_VALUE && ist->next_dts == AV_NOPTS_VALUE && !copy_ts && (is->iformat->flags & AVFMT_TS_DISCONT) && ifile->last_ts != AV_NOPTS_VALUE) { - int64_t pkt_dts = av_rescale_q(pkt.dts, ist->st->time_base, AV_TIME_BASE_Q); int64_t delta = pkt_dts - ifile->last_ts; if (delta < -1LL*dts_delta_threshold*AV_TIME_BASE || delta > 1LL*dts_delta_threshold*AV_TIME_BASE){ @@ -3907,11 +3908,11 @@ static int process_input(int file_index) if (pkt.dts != AV_NOPTS_VALUE) pkt.dts += duration; + pkt_dts = av_rescale_q_rnd(pkt.dts, ist->st->time_base, AV_TIME_BASE_Q, AV_ROUND_NEAR_INF|AV_ROUND_PASS_MINMAX); if ((ist->dec_ctx->codec_type == AVMEDIA_TYPE_VIDEO || ist->dec_ctx->codec_type == AVMEDIA_TYPE_AUDIO) && - pkt.dts != AV_NOPTS_VALUE && ist->next_dts != AV_NOPTS_VALUE && + pkt_dts != AV_NOPTS_VALUE && ist->next_dts != AV_NOPTS_VALUE && !copy_ts) { - int64_t pkt_dts = av_rescale_q(pkt.dts, ist->st->time_base, AV_TIME_BASE_Q); int64_t delta = pkt_dts - ist->next_dts; if (is->iformat->flags & AVFMT_TS_DISCONT) { if (delta < -1LL*dts_delta_threshold*AV_TIME_BASE || |