[FFmpeg-cvslog] avutil/parseutils: fix some overflows in duration calculations

[Marton Balint]

ffmpeg | branch: master | Marton Balint <cus at passwd.hu> | Sun Sep 30 22:34:41 2018 +0200| [4c777d52b9b1048ba92cab1a658c218c38282d25] | committer: Marton Balint

avutil/parseutils: fix some overflows in duration calculations

Also properly return AVERROR(ERANGE) in case of actual overflows.

Signed-off-by: Marton Balint <cus at passwd.hu>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4c777d52b9b1048ba92cab1a658c218c38282d25
---

 libavutil/parseutils.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/libavutil/parseutils.c b/libavutil/parseutils.c
index 924c49d52c..59bec6cc9d 100644
--- a/libavutil/parseutils.c
+++ b/libavutil/parseutils.c
@@ -661,12 +661,15 @@ int av_parse_time(int64_t *timeval, const char *timestr, int duration)
         if (!q) {
             char *o;
             /* parse timestr as S+ */
-            dt.tm_sec = strtol(p, &o, 10);
+            errno = 0;
+            t = strtoll(p, &o, 10);
             if (o == p) /* the parsing didn't succeed */
                 return AVERROR(EINVAL);
-            dt.tm_min = 0;
-            dt.tm_hour = 0;
+            if (errno == ERANGE)
+                return AVERROR(ERANGE);
             q = o;
+        } else {
+            t = dt.tm_hour * 3600 + dt.tm_min * 60 + dt.tm_sec;
         }
     }
 
@@ -688,7 +691,6 @@ int av_parse_time(int64_t *timeval, const char *timestr, int duration)
     }
 
     if (duration) {
-        t = dt.tm_hour * 3600 + dt.tm_min * 60 + dt.tm_sec;
         if (q[0] == 'm' && q[1] == 's') {
             suffix = 1000;
             microseconds /= 1000;
@@ -734,7 +736,11 @@ int av_parse_time(int64_t *timeval, const char *timestr, int duration)
     if (*q)
         return AVERROR(EINVAL);
 
+    if (INT64_MAX / suffix < t)
+        return AVERROR(ERANGE);
     t *= suffix;
+    if (INT64_MAX - microseconds < t)
+        return AVERROR(ERANGE);
     t += microseconds;
     *timeval = negative ? -t : t;
     return 0;