[FFmpeg-cvslog] avformat/mov: Fix integer overflow in mov_read_packet().

[Dale Curtis]

ffmpeg | branch: release/4.4 | Dale Curtis <dalecurtis at chromium.org> | Wed Nov 22 22:17:37 2023 +0000| [207e003758d80ffa595e21543007021659c0e535] | committer: Michael Niedermayer

avformat/mov: Fix integer overflow in mov_read_packet().

Fixes https://crbug.com/1499669:
runtime error: signed integer overflow: 9223372036853334272 + 1375731456
cannot be represented in type 'int64_t' (aka 'long')

Signed-off-by: Dale Curtis <dalecurtis at chromium.org>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 2182173a6933c02b0853751034bd5e0bf829b5f7)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=207e003758d80ffa595e21543007021659c0e535
---

 libavformat/mov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 539eec0eef..2db8406a39 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -8057,7 +8057,7 @@ static int mov_read_packet(AVFormatContext *s, AVPacket *pkt)
         pkt->flags |= AV_PKT_FLAG_DISCARD;
     }
     if (sc->ctts_data && sc->ctts_index < sc->ctts_count) {
-        pkt->pts = pkt->dts + sc->dts_shift + sc->ctts_data[sc->ctts_index].duration;
+        pkt->pts = av_sat_add64(pkt->dts, av_sat_add64(sc->dts_shift, sc->ctts_data[sc->ctts_index].duration));
         /* update ctts context */
         sc->ctts_sample++;
         if (sc->ctts_index < sc->ctts_count &&