avformat/mxfenc: Fix integer overflow in length computation
authorMichael Niedermayer <michael@niedermayer.cc>
Wed, 9 Dec 2015 17:13:25 +0000 (18:13 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Sun, 13 Dec 2015 01:15:14 +0000 (02:15 +0100)
Fixes: CID1341577

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 537e901fe66c326f78e916ee9393830ee366131d)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavformat/mxfenc.c

index 66e1f07..9e23bed 100644 (file)
@@ -1266,11 +1266,11 @@ static void mxf_write_package(AVFormatContext *s, enum MXFMetadataSetType type,
             user_comment_count = mxf_write_user_comments(s, s->metadata);
         mxf_write_metadata_key(pb, 0x013600);
         PRINT_KEY(s, "Material Package key", pb->buf_ptr - 16);
-        klv_encode_ber_length(pb, 92 + name_size + (16*track_count) + (16*user_comment_count) + 12*mxf->store_user_comments);
+        klv_encode_ber_length(pb, 92 + name_size + (16*track_count) + (16*user_comment_count) + 12LL*mxf->store_user_comments);
     } else {
         mxf_write_metadata_key(pb, 0x013700);
         PRINT_KEY(s, "Source Package key", pb->buf_ptr - 16);
-        klv_encode_ber_length(pb, 112 + name_size + (16*track_count) + 12*mxf->store_user_comments); // 20 bytes length for descriptor reference
+        klv_encode_ber_length(pb, 112 + name_size + (16*track_count) + 12LL*mxf->store_user_comments); // 20 bytes length for descriptor reference
     }
 
     // write uid