mov: prevent overflow during bit rate calculation

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
pull/242/head
Andreas Cadhalpun 8 years ago
parent baba9c6aef
commit 076c3a9fa2
  1. 15
      libavformat/mov.c

@ -5887,8 +5887,15 @@ static int mov_read_header(AVFormatContext *s)
for (i = 0; i < s->nb_streams; i++) {
AVStream *st = s->streams[i];
MOVStreamContext *sc = st->priv_data;
if (st->duration > 0)
if (st->duration > 0) {
if (sc->data_size > INT64_MAX / sc->time_scale / 8) {
av_log(s, AV_LOG_ERROR, "Overflow during bit rate calculation %"PRId64" * 8 * %d\n",
sc->data_size, sc->time_scale);
mov_read_close(s);
return AVERROR_INVALIDDATA;
}
st->codecpar->bit_rate = sc->data_size * 8 * sc->time_scale / st->duration;
}
}
}
@ -5897,6 +5904,12 @@ static int mov_read_header(AVFormatContext *s)
AVStream *st = s->streams[i];
MOVStreamContext *sc = st->priv_data;
if (sc->duration_for_fps > 0) {
if (sc->data_size > INT64_MAX / sc->time_scale / 8) {
av_log(s, AV_LOG_ERROR, "Overflow during bit rate calculation %"PRId64" * 8 * %d\n",
sc->data_size, sc->time_scale);
mov_read_close(s);
return AVERROR_INVALIDDATA;
}
st->codecpar->bit_rate = sc->data_size * 8 * sc->time_scale /
sc->duration_for_fps;
}

Loading…
Cancel
Save