1. 15 Oct, 2015 2 commits
  2. 14 Oct, 2015 37 commits
  3. 13 Oct, 2015 1 commit
    • Ganesh Ajjanagadde's avatar
      avformat/mov: fix integer overflow · d59bfcd1
      Ganesh Ajjanagadde authored
      Partially fixes Ticket 4727.
      
      -duration is not a safe expression, since duration can be INT_MIN.
      One might ask how it can become INT_MIN.
      Although it is true that line 2574 is no longer reached with INT_MIN due
      to commit 053e80f6 (which fixed another
      integer overflow issue), mov_update_dts_shift is called on line 3549 as
      well, right after a read of untrusted data.
      One can do the fix locally there, but that function is already a huge
      mess. Changing mov_update_dts_shift is likely better.
      
      This changes duration to INT_MIN + 1 in such cases. This should not make any
      practical difference since such streams are anyway fuzzer files.
      
      Tested with FATE.
      Reviewed-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
      Signed-off-by: 's avatarGanesh Ajjanagadde <gajjanagadde@gmail.com>
      d59bfcd1