avformat/mxfenc: Fix integer overflow in length computation

Fixes: CID1341577

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/166/head
Michael Niedermayer 9 years ago
parent e6258677ee
commit 537e901fe6
  1. 4
      libavformat/mxfenc.c

@ -1268,11 +1268,11 @@ static void mxf_write_package(AVFormatContext *s, enum MXFMetadataSetType type,
user_comment_count = mxf_write_user_comments(s, s->metadata);
mxf_write_metadata_key(pb, 0x013600);
PRINT_KEY(s, "Material Package key", pb->buf_ptr - 16);
klv_encode_ber_length(pb, 92 + name_size + (16*track_count) + (16*user_comment_count) + 12*mxf->store_user_comments);
klv_encode_ber_length(pb, 92 + name_size + (16*track_count) + (16*user_comment_count) + 12LL*mxf->store_user_comments);
} else {
mxf_write_metadata_key(pb, 0x013700);
PRINT_KEY(s, "Source Package key", pb->buf_ptr - 16);
klv_encode_ber_length(pb, 112 + name_size + (16*track_count) + 12*mxf->store_user_comments); // 20 bytes length for descriptor reference
klv_encode_ber_length(pb, 112 + name_size + (16*track_count) + 12LL*mxf->store_user_comments); // 20 bytes length for descriptor reference
}
// write uid

Loading…
Cancel
Save