libavformat/mov: limit nb_frames_for_fps to INT_MAX
authorDan Sanders <sandersd@google.com>
Mon, 22 Apr 2019 18:05:00 +0000 (11:05 -0700)
committerMichael Niedermayer <michael@niedermayer.cc>
Tue, 23 Apr 2019 20:13:34 +0000 (22:13 +0200)
It's this or add overflow detection in mov_read_header().

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/mov.c

index d5ce077..247a65e 100644 (file)
@@ -2940,7 +2940,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
 
     if (duration > 0 &&
         duration <= INT64_MAX - sc->duration_for_fps &&
-        total_sample_count <= INT64_MAX - sc->nb_frames_for_fps
+        total_sample_count <= INT_MAX - sc->nb_frames_for_fps
     ) {
         sc->duration_for_fps  += duration;
         sc->nb_frames_for_fps += total_sample_count;
@@ -4897,7 +4897,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
         sc->data_size += sample_size;
 
         if (sample_duration <= INT64_MAX - sc->duration_for_fps &&
-            1 <= INT64_MAX - sc->nb_frames_for_fps
+            1 <= INT_MAX - sc->nb_frames_for_fps
         ) {
             sc->duration_for_fps += sample_duration;
             sc->nb_frames_for_fps ++;