diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-12-14 01:53:23 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-12-15 01:25:50 +0100 |
| commit | 076c3a9fa23ca2b0dd167a087ab1e4fb4357a31b (patch) | |
| tree | 1392e29092cb12beee4f1c92ff5057b7c421fe6c | |
| parent | baba9c6aef88727bb0182631dc67744d36cadea4 (diff) | |
| download | ffmpeg-streaming-076c3a9fa23ca2b0dd167a087ab1e4fb4357a31b.zip ffmpeg-streaming-076c3a9fa23ca2b0dd167a087ab1e4fb4357a31b.tar.gz | |
mov: prevent overflow during bit rate calculation
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
| -rw-r--r-- | libavformat/mov.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 6c8affc..fc0b25c 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5887,8 +5887,15 @@ static int mov_read_header(AVFormatContext *s) for (i = 0; i < s->nb_streams; i++) { AVStream *st = s->streams[i]; MOVStreamContext *sc = st->priv_data; - if (st->duration > 0) + if (st->duration > 0) { + if (sc->data_size > INT64_MAX / sc->time_scale / 8) { + av_log(s, AV_LOG_ERROR, "Overflow during bit rate calculation %"PRId64" * 8 * %d\n", + sc->data_size, sc->time_scale); + mov_read_close(s); + return AVERROR_INVALIDDATA; + } st->codecpar->bit_rate = sc->data_size * 8 * sc->time_scale / st->duration; + } } } @@ -5897,6 +5904,12 @@ static int mov_read_header(AVFormatContext *s) AVStream *st = s->streams[i]; MOVStreamContext *sc = st->priv_data; if (sc->duration_for_fps > 0) { + if (sc->data_size > INT64_MAX / sc->time_scale / 8) { + av_log(s, AV_LOG_ERROR, "Overflow during bit rate calculation %"PRId64" * 8 * %d\n", + sc->data_size, sc->time_scale); + mov_read_close(s); + return AVERROR_INVALIDDATA; + } st->codecpar->bit_rate = sc->data_size * 8 * sc->time_scale / sc->duration_for_fps; } |
