[FFmpeg-cvslog] avformat/movenc: Avoid integer overflow

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sun May 29 03:51:42 2016 +0200| [17d320800b70a78f4e90cd96564154e829db8b8d] | committer: Michael Niedermayer

avformat/movenc: Avoid integer overflow

Fixes: CID1361947

Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=17d320800b70a78f4e90cd96564154e829db8b8d
---

 libavformat/movenc.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index 51c3d2b..f967124 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -2454,7 +2454,11 @@ static int mov_write_tkhd_tag(AVIOContext *pb, MOVMuxContext *mov,
             if (!track_width_1616 ||
                 track->height != track->par->height ||
                 track_width_1616 > UINT32_MAX)
-                track_width_1616 = track->par->width * 0x10000U;
+                track_width_1616 = track->par->width * 0x10000ULL;
+            if (track_width_1616 > UINT32_MAX) {
+                av_log(mov->fc, AV_LOG_WARNING, "track width too large\n");
+                track_width_1616 = 0;
+            }
             avio_wb32(pb, track_width_1616);
             avio_wb32(pb, track->height * 0x10000U);
         }