Commit e3ba817b authored by Tomas Härdin's avatar Tomas Härdin Committed by Michael Niedermayer

mxfenc: Fix possible integer overflows

None of these are likely unless the user is writing a file with two billion
streams or a duration of around two months.

This fixes CIDs 700568, 700569, 700570, 700571, 700572 and 700573.
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent fbb39f44
...@@ -550,7 +550,7 @@ static void mxf_write_preface(AVFormatContext *s) ...@@ -550,7 +550,7 @@ static void mxf_write_preface(AVFormatContext *s)
mxf_write_metadata_key(pb, 0x012f00); mxf_write_metadata_key(pb, 0x012f00);
PRINT_KEY(s, "preface key", pb->buf_ptr - 16); PRINT_KEY(s, "preface key", pb->buf_ptr - 16);
klv_encode_ber_length(pb, 130 + 16 * mxf->essence_container_count); klv_encode_ber_length(pb, 130 + 16LL * mxf->essence_container_count);
// write preface set uid // write preface set uid
mxf_write_local_tag(pb, 16, 0x3C0A); mxf_write_local_tag(pb, 16, 0x3C0A);
...@@ -823,7 +823,7 @@ static void mxf_write_multi_descriptor(AVFormatContext *s) ...@@ -823,7 +823,7 @@ static void mxf_write_multi_descriptor(AVFormatContext *s)
mxf_write_metadata_key(pb, 0x014400); mxf_write_metadata_key(pb, 0x014400);
PRINT_KEY(s, "multiple descriptor key", pb->buf_ptr - 16); PRINT_KEY(s, "multiple descriptor key", pb->buf_ptr - 16);
klv_encode_ber_length(pb, 64 + 16 * s->nb_streams); klv_encode_ber_length(pb, 64 + 16LL * s->nb_streams);
mxf_write_local_tag(pb, 16, 0x3C0A); mxf_write_local_tag(pb, 16, 0x3C0A);
mxf_write_uuid(pb, MultipleDescriptor, 0); mxf_write_uuid(pb, MultipleDescriptor, 0);
...@@ -1165,8 +1165,8 @@ static void mxf_write_index_table_segment(AVFormatContext *s) ...@@ -1165,8 +1165,8 @@ static void mxf_write_index_table_segment(AVFormatContext *s)
if (mxf->edit_unit_byte_count) { if (mxf->edit_unit_byte_count) {
klv_encode_ber_length(pb, 80); klv_encode_ber_length(pb, 80);
} else { } else {
klv_encode_ber_length(pb, 85 + 12+(s->nb_streams+1)*6 + klv_encode_ber_length(pb, 85 + 12+(s->nb_streams+1LL)*6 +
12+mxf->edit_units_count*(11+mxf->slice_count*4)); 12+mxf->edit_units_count*(11+mxf->slice_count*4LL));
} }
// instance id // instance id
...@@ -1326,7 +1326,7 @@ static void mxf_write_partition(AVFormatContext *s, int bodysid, ...@@ -1326,7 +1326,7 @@ static void mxf_write_partition(AVFormatContext *s, int bodysid,
// write klv // write klv
avio_write(pb, key, 16); avio_write(pb, key, 16);
klv_encode_ber_length(pb, 88 + 16 * mxf->essence_container_count); klv_encode_ber_length(pb, 88 + 16LL * mxf->essence_container_count);
// write partition value // write partition value
avio_wb16(pb, 1); // majorVersion avio_wb16(pb, 1); // majorVersion
...@@ -2004,7 +2004,7 @@ static void mxf_write_random_index_pack(AVFormatContext *s) ...@@ -2004,7 +2004,7 @@ static void mxf_write_random_index_pack(AVFormatContext *s)
int i; int i;
avio_write(pb, random_index_pack_key, 16); avio_write(pb, random_index_pack_key, 16);
klv_encode_ber_length(pb, 28 + 12*mxf->body_partitions_count); klv_encode_ber_length(pb, 28 + 12LL*mxf->body_partitions_count);
if (mxf->edit_unit_byte_count) if (mxf->edit_unit_byte_count)
avio_wb32(pb, 1); // BodySID of header partition avio_wb32(pb, 1); // BodySID of header partition
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment