diff options
| author | Anton Khirnov <anton@khirnov.net> | 2016-12-17 15:07:51 +0100 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2016-12-19 08:15:07 +0100 |
| commit | 58405de0951a843765625159402870c1eea3c3b1 (patch) | |
| tree | ad2970a039a36ff313481433afea87a0421d6bbb | |
| parent | 46191a2da16f751e53d93646ae1388d421d12bee (diff) | |
mpegvideo_parser: avoid signed overflow in bitrate calculation
CC: libav-stable@libav.org
Bug-Id: 981
Found-By: Agostino Sarubbo
| -rw-r--r-- | libavcodec/mpegvideo_parser.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libavcodec/mpegvideo_parser.c b/libavcodec/mpegvideo_parser.c index 27f2985509..500d1240ef 100644 --- a/libavcodec/mpegvideo_parser.c +++ b/libavcodec/mpegvideo_parser.c @@ -97,7 +97,14 @@ static void mpegvideo_extract_headers(AVCodecParserContext *s, pc->width |=(horiz_size_ext << 12); pc->height |=( vert_size_ext << 12); - avctx->bit_rate += (bit_rate_ext << 18) * 400; + + bit_rate_ext <<= 18; + if (bit_rate_ext < INT_MAX / 400 && + bit_rate_ext * 400 < INT_MAX - avctx->bit_rate) { + avctx->bit_rate += bit_rate_ext * 400; + } else + avctx->bit_rate = 0; + if(did_set_size) ff_set_dimensions(avctx, pc->width, pc->height); avctx->framerate.num = pc->frame_rate.num * (frame_rate_ext_n + 1) * 2; |