diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-05-29 03:51:42 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-05-29 03:56:23 +0200 |
| commit | 17d320800b70a78f4e90cd96564154e829db8b8d (patch) | |
| tree | f988d1b461b51963576e6b61478e7d82864b4ae1 /libavformat/movenc.c | |
| parent | 1a82d2cf8fb6a7e854e7548dfcf73c3d046b34ac (diff) | |
avformat/movenc: Avoid integer overflow
Fixes: CID1361947
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/movenc.c')
| -rw-r--r-- | libavformat/movenc.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 51c3d2bd6d..f96712435e 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -2454,7 +2454,11 @@ static int mov_write_tkhd_tag(AVIOContext *pb, MOVMuxContext *mov, if (!track_width_1616 || track->height != track->par->height || track_width_1616 > UINT32_MAX) - track_width_1616 = track->par->width * 0x10000U; + track_width_1616 = track->par->width * 0x10000ULL; + if (track_width_1616 > UINT32_MAX) { + av_log(mov->fc, AV_LOG_WARNING, "track width too large\n"); + track_width_1616 = 0; + } avio_wb32(pb, track_width_1616); avio_wb32(pb, track->height * 0x10000U); } |