wtv: detect ole date overflow

1 files changed, 13 insertions, 5 deletions

diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c
index c775dfba2e..19d5b54ce0 100644
--- a/libavformat/wtvdec.c
+++ b/libavformat/wtvdec.c
@@ -398,11 +398,16 @@ static void crazytime_to_iso8601(char *buf, int buf_size, int64_t value)
 
 /**
  * Convert OLE DATE to ISO-8601 string
+ * @return <0 on error
  */
-static void oledate_to_iso8601(char *buf, int buf_size, int64_t value)
+static int oledate_to_iso8601(char *buf, int buf_size, int64_t value)
 {
     time_t t = 631112400LL + 86400*av_int2dbl(value);
-    strftime(buf, buf_size, "%Y-%m-%d %H:%M:%S", gmtime(&t));
+    struct tm result;
+    if (!gmtime_r(&t, &result))
+        return -1;
+    strftime(buf, buf_size, "%Y-%m-%d %H:%M:%S", &result);
+    return 0;
 }
 
 static void get_attachment(AVFormatContext *s, AVIOContext *pb, int length)
@@ -463,9 +468,12 @@ static void get_tag(AVFormatContext *s, AVIOContext *pb, const char *key, int ty
         else if (!strcmp(key, "WM/WMRVEncodeTime") ||
                  !strcmp(key, "WM/WMRVEndTime"))
             crazytime_to_iso8601(buf, buf_size, num);
-        else if (!strcmp(key, "WM/WMRVExpirationDate"))
-            oledate_to_iso8601(buf, buf_size, num);
-        else if (!strcmp(key, "WM/WMRVBitrate"))
+        else if (!strcmp(key, "WM/WMRVExpirationDate")) {
+            if (oledate_to_iso8601(buf, buf_size, num) < 0 ) {
+                av_free(buf);
+                return;
+            }
+        } else if (!strcmp(key, "WM/WMRVBitrate"))
             snprintf(buf, buf_size, "%f", av_int2dbl(num));
         else
             snprintf(buf, buf_size, "%"PRIi64, num);