[FFmpeg-cvslog] avformat/mov: Fix potential integer overflow in entry check in mov_read_trun()
Michael Niedermayer
git at videolan.org
Mon Apr 1 02:02:01 EEST 2019
ffmpeg | branch: release/4.1 | Michael Niedermayer <michael at niedermayer.cc> | Sun Mar 17 11:14:26 2019 +0100| [ad0f4a7d10f91c63cceeb25010bec83311ad84fa] | committer: Michael Niedermayer
avformat/mov: Fix potential integer overflow in entry check in mov_read_trun()
No testcase
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit ff13a92a6f8413402f5b3cacedda7c10d350b487)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ad0f4a7d10f91c63cceeb25010bec83311ad84fa
---
libavformat/mov.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 60309b4869..caba256161 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4781,7 +4781,7 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
av_log(c->fc, AV_LOG_TRACE, "first sample flags 0x%x\n", first_sample_flags);
// realloc space for new index entries
- if((unsigned)st->nb_index_entries + entries >= UINT_MAX / sizeof(AVIndexEntry)) {
+ if((uint64_t)st->nb_index_entries + entries >= UINT_MAX / sizeof(AVIndexEntry)) {
entries = UINT_MAX / sizeof(AVIndexEntry) - st->nb_index_entries;
av_log(c->fc, AV_LOG_ERROR, "Failed to add index entry\n");
}
More information about the ffmpeg-cvslog
mailing list