lavf: avoid integer overflow in ff_compute_frame_duration()
authorJanne Grunau <janne-libav@jannau.net>
Fri, 23 Nov 2012 13:05:36 +0000 (14:05 +0100)
committerReinhard Tartler <siretart@tauware.de>
Sun, 10 Feb 2013 17:01:15 +0000 (18:01 +0100)
Scaling the denominator instead of the numerator if it is too large
loses precision. Fixes an assert caused by a negative frame duration in
the fuzzed sample nasa-8s2.ts_s202310.

CC: libav-stable@libav.org
(cherry picked from commit 7709ce029a7bc101b9ac1ceee607cda10dcb89dc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
libavformat/utils.c

index 223d567..2715023 100644 (file)
@@ -680,7 +680,10 @@ static void compute_frame_duration(int *pnum, int *pden, AVStream *st,
             *pnum = st->codec->time_base.num;
             *pden = st->codec->time_base.den;
             if (pc && pc->repeat_pict) {
-                *pnum = (*pnum) * (1 + pc->repeat_pict);
+                if (*pnum > INT_MAX / (1 + pc->repeat_pict))
+                    *pden /= 1 + pc->repeat_pict;
+                else
+                    *pnum *= 1 + pc->repeat_pict;
             }
         }
         break;