avformat/mov: Fix potential integer overflow in entry check in mov_read_trun()
authorMichael Niedermayer <michael@niedermayer.cc>
Sun, 17 Mar 2019 10:14:26 +0000 (11:14 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Mon, 25 Mar 2019 12:20:30 +0000 (13:20 +0100)
No testcase

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/mov.c

index 9e5670c..d5ce077 100644 (file)
@@ -4778,7 +4778,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     av_log(c->fc, AV_LOG_TRACE, "first sample flags 0x%x\n", first_sample_flags);
 
     // realloc space for new index entries
-    if((unsigned)st->nb_index_entries + entries >= UINT_MAX / sizeof(AVIndexEntry)) {
+    if((uint64_t)st->nb_index_entries + entries >= UINT_MAX / sizeof(AVIndexEntry)) {
         entries = UINT_MAX / sizeof(AVIndexEntry) - st->nb_index_entries;
         av_log(c->fc, AV_LOG_ERROR, "Failed to add index entry\n");
     }