Commit 076c3a9f authored by Andreas Cadhalpun's avatar Andreas Cadhalpun

mov: prevent overflow during bit rate calculation

Reviewed-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
Signed-off-by: 's avatarAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
parent baba9c6a
......@@ -5887,8 +5887,15 @@ static int mov_read_header(AVFormatContext *s)
for (i = 0; i < s->nb_streams; i++) {
AVStream *st = s->streams[i];
MOVStreamContext *sc = st->priv_data;
if (st->duration > 0)
if (st->duration > 0) {
if (sc->data_size > INT64_MAX / sc->time_scale / 8) {
av_log(s, AV_LOG_ERROR, "Overflow during bit rate calculation %"PRId64" * 8 * %d\n",
sc->data_size, sc->time_scale);
mov_read_close(s);
return AVERROR_INVALIDDATA;
}
st->codecpar->bit_rate = sc->data_size * 8 * sc->time_scale / st->duration;
}
}
}
......@@ -5897,6 +5904,12 @@ static int mov_read_header(AVFormatContext *s)
AVStream *st = s->streams[i];
MOVStreamContext *sc = st->priv_data;
if (sc->duration_for_fps > 0) {
if (sc->data_size > INT64_MAX / sc->time_scale / 8) {
av_log(s, AV_LOG_ERROR, "Overflow during bit rate calculation %"PRId64" * 8 * %d\n",
sc->data_size, sc->time_scale);
mov_read_close(s);
return AVERROR_INVALIDDATA;
}
st->codecpar->bit_rate = sc->data_size * 8 * sc->time_scale /
sc->duration_for_fps;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment