From 22c820f509043afb73682ff4bc82ef006af2a74a Mon Sep 17 00:00:00 2001 From: Dan Sanders Date: Mon, 22 Apr 2019 11:05:00 -0700 Subject: libavformat/mov: limit nb_frames_for_fps to INT_MAX It's this or add overflow detection in mov_read_header(). Signed-off-by: Michael Niedermayer --- libavformat/mov.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libavformat') diff --git a/libavformat/mov.c b/libavformat/mov.c index d5ce077e63..247a65ed11 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2940,7 +2940,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (duration > 0 && duration <= INT64_MAX - sc->duration_for_fps && - total_sample_count <= INT64_MAX - sc->nb_frames_for_fps + total_sample_count <= INT_MAX - sc->nb_frames_for_fps ) { sc->duration_for_fps += duration; sc->nb_frames_for_fps += total_sample_count; @@ -4897,7 +4897,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom) sc->data_size += sample_size; if (sample_duration <= INT64_MAX - sc->duration_for_fps && - 1 <= INT64_MAX - sc->nb_frames_for_fps + 1 <= INT_MAX - sc->nb_frames_for_fps ) { sc->duration_for_fps += sample_duration; sc->nb_frames_for_fps ++; -- cgit v1.2.3