lavf: avoid integer overflow when estimating bitrate
authorAnton Khirnov <anton@khirnov.net>
Sat, 24 Aug 2013 19:30:46 +0000 (21:30 +0200)
committerAnton Khirnov <anton@khirnov.net>
Mon, 2 Sep 2013 17:28:29 +0000 (19:28 +0200)
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
libavformat/utils.c

index eb89f436368bda488c03bd248702a08b8e4251c9..3644bcd724076db719f8a2ec54d6a94e15cd9444 100644 (file)
@@ -1757,8 +1757,13 @@ static void estimate_timings_from_bit_rate(AVFormatContext *ic)
         int bit_rate = 0;
         for(i=0;i<ic->nb_streams;i++) {
             st = ic->streams[i];
         int bit_rate = 0;
         for(i=0;i<ic->nb_streams;i++) {
             st = ic->streams[i];
-            if (st->codec->bit_rate > 0)
-            bit_rate += st->codec->bit_rate;
+            if (st->codec->bit_rate > 0) {
+                if (INT_MAX - st->codec->bit_rate > bit_rate) {
+                    bit_rate = 0;
+                    break;
+                }
+                bit_rate += st->codec->bit_rate;
+            }
         }
         ic->bit_rate = bit_rate;
     }
         }
         ic->bit_rate = bit_rate;
     }