lavf: avoid integer overflow in ff_compute_frame_duration()
authorJanne Grunau <janne-libav@jannau.net>
Fri, 23 Nov 2012 13:05:36 +0000 (14:05 +0100)
committerReinhard Tartler <siretart@tauware.de>
Sat, 12 Jan 2013 16:59:39 +0000 (17:59 +0100)
Scaling the denominator instead of the numerator if it is too large
loses precision. Fixes an assert caused by a negative frame duration in
the fuzzed sample nasa-8s2.ts_s202310.

CC: libav-stable@libav.org
(cherry picked from commit 7709ce029a7bc101b9ac1ceee607cda10dcb89dc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
libavformat/utils.c

index 240cd94..9dc1dcb 100644 (file)
@@ -838,7 +838,10 @@ static void compute_frame_duration(int *pnum, int *pden, AVStream *st,
             *pnum = st->codec->time_base.num;
             *pden = st->codec->time_base.den;
             if (pc && pc->repeat_pict) {
-                *pnum = (*pnum) * (1 + pc->repeat_pict);
+                if (*pnum > INT_MAX / (1 + pc->repeat_pict))
+                    *pden /= 1 + pc->repeat_pict;
+                else
+                    *pnum *= 1 + pc->repeat_pict;
             }
             //If this codec can be interlaced or progressive then we need a parser to compute duration of a packet
             //Thus if we have no parser in such case leave duration undefined.