diff options
| author | Dan Sanders <sandersd@google.com> | 2019-04-22 11:05:00 -0700 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-04-23 22:13:34 +0200 |
| commit | 22c820f509043afb73682ff4bc82ef006af2a74a (patch) | |
| tree | 4862322dcfb1acddb40d0a7efa9b08568e02e8c8 /libavformat | |
| parent | 4a69b18242dc39ee50993d55e985d3b2cbbef10b (diff) | |
libavformat/mov: limit nb_frames_for_fps to INT_MAX
It's this or add overflow detection in mov_read_header().
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/mov.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index d5ce077e63..247a65ed11 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2940,7 +2940,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (duration > 0 && duration <= INT64_MAX - sc->duration_for_fps && - total_sample_count <= INT64_MAX - sc->nb_frames_for_fps + total_sample_count <= INT_MAX - sc->nb_frames_for_fps ) { sc->duration_for_fps += duration; sc->nb_frames_for_fps += total_sample_count; @@ -4897,7 +4897,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom) sc->data_size += sample_size; if (sample_duration <= INT64_MAX - sc->duration_for_fps && - 1 <= INT64_MAX - sc->nb_frames_for_fps + 1 <= INT_MAX - sc->nb_frames_for_fps ) { sc->duration_for_fps += sample_duration; sc->nb_frames_for_fps ++; |