Commit 22c820f5 authored by Dan Sanders's avatar Dan Sanders Committed by Michael Niedermayer

libavformat/mov: limit nb_frames_for_fps to INT_MAX

It's this or add overflow detection in mov_read_header().
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 4a69b182
...@@ -2940,7 +2940,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom) ...@@ -2940,7 +2940,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
if (duration > 0 && if (duration > 0 &&
duration <= INT64_MAX - sc->duration_for_fps && duration <= INT64_MAX - sc->duration_for_fps &&
total_sample_count <= INT64_MAX - sc->nb_frames_for_fps total_sample_count <= INT_MAX - sc->nb_frames_for_fps
) { ) {
sc->duration_for_fps += duration; sc->duration_for_fps += duration;
sc->nb_frames_for_fps += total_sample_count; sc->nb_frames_for_fps += total_sample_count;
...@@ -4897,7 +4897,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom) ...@@ -4897,7 +4897,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
sc->data_size += sample_size; sc->data_size += sample_size;
if (sample_duration <= INT64_MAX - sc->duration_for_fps && if (sample_duration <= INT64_MAX - sc->duration_for_fps &&
1 <= INT64_MAX - sc->nb_frames_for_fps 1 <= INT_MAX - sc->nb_frames_for_fps
) { ) {
sc->duration_for_fps += sample_duration; sc->duration_for_fps += sample_duration;
sc->nb_frames_for_fps ++; sc->nb_frames_for_fps ++;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment