[FFmpeg-cvslog] avformat/mxfdec: avoid index_table->nb_ptses overflow in mxf_compute_ptses_fake_index

[Marton Balint]

ffmpeg | branch: master | Marton Balint <cus at passwd.hu> | Tue Jun 12 23:42:16 2018 +0200| [404dc6bab5cd1904daeb11affe3c67c02b8eec40] | committer: Marton Balint

avformat/mxfdec: avoid index_table->nb_ptses overflow in mxf_compute_ptses_fake_index

Signed-off-by: Marton Balint <cus at passwd.hu>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=404dc6bab5cd1904daeb11affe3c67c02b8eec40
---

 libavformat/mxfdec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index fb400bf663..8c417aea26 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1528,6 +1528,12 @@ static int mxf_compute_ptses_fake_index(MXFContext *mxf, MXFIndexTable *index_ta
             return 0;                               /* no TemporalOffsets */
         }
 
+        if (s->index_duration > INT_MAX - index_table->nb_ptses) {
+            index_table->nb_ptses = 0;
+            av_log(mxf->fc, AV_LOG_ERROR, "ignoring IndexSID %d, duration is too large\n", s->index_sid);
+            return 0;
+        }
+
         index_table->nb_ptses += s->index_duration;
     }