[libav-commits] lavf: avoid integer overflow in ff_compute_frame_duration()

Janne Grunau git at libav.org
Sat Jan 12 20:10:22 CET 2013


Module: libav
Branch: release/0.7
Commit: 10ff052c601368f129466e6de19e9862aaaec7d1

Author:    Janne Grunau <janne-libav at jannau.net>
Committer: Reinhard Tartler <siretart at tauware.de>
Date:      Fri Nov 23 14:05:36 2012 +0100

lavf: avoid integer overflow in ff_compute_frame_duration()

Scaling the denominator instead of the numerator if it is too large
loses precision. Fixes an assert caused by a negative frame duration in
the fuzzed sample nasa-8s2.ts_s202310.

CC: libav-stable at libav.org
(cherry picked from commit 7709ce029a7bc101b9ac1ceee607cda10dcb89dc)

Signed-off-by: Reinhard Tartler <siretart at tauware.de>

---

 libavformat/utils.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/libavformat/utils.c b/libavformat/utils.c
index 5f3da49..be67925 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -813,7 +813,10 @@ static void compute_frame_duration(int *pnum, int *pden, AVStream *st,
             *pnum = st->codec->time_base.num;
             *pden = st->codec->time_base.den;
             if (pc && pc->repeat_pict) {
-                *pnum = (*pnum) * (1 + pc->repeat_pict);
+                if (*pnum > INT_MAX / (1 + pc->repeat_pict))
+                    *pden /= 1 + pc->repeat_pict;
+                else
+                    *pnum *= 1 + pc->repeat_pict;
             }
             //If this codec can be interlaced or progressive then we need a parser to compute duration of a packet
             //Thus if we have no parser in such case leave duration undefined.



More information about the libav-commits mailing list