[FFmpeg-devel] [PATCH] avformat/mxfenc: Fix integer overflow in length computation

[Tomas Härdin]

On Wed, 2015-12-09 at 18:13 +0100, Michael Niedermayer wrote:
> From: Michael Niedermayer <michael at niedermayer.cc>
> 
> Fixes: CID1341577
> 
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavformat/mxfenc.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/libavformat/mxfenc.c b/libavformat/mxfenc.c
> index e4e4272..043daff 100644
> --- a/libavformat/mxfenc.c
> +++ b/libavformat/mxfenc.c
> @@ -1268,11 +1268,11 @@ static void mxf_write_package(AVFormatContext *s, enum MXFMetadataSetType type,
>              user_comment_count = mxf_write_user_comments(s, s->metadata);
>          mxf_write_metadata_key(pb, 0x013600);
>          PRINT_KEY(s, "Material Package key", pb->buf_ptr - 16);
> -        klv_encode_ber_length(pb, 92 + name_size + (16*track_count) + (16*user_comment_count) + 12*mxf->store_user_comments);
> +        klv_encode_ber_length(pb, 92 + name_size + (16*track_count) + (16*user_comment_count) + 12LL*mxf->store_user_comments);
>      } else {
>          mxf_write_metadata_key(pb, 0x013700);
>          PRINT_KEY(s, "Source Package key", pb->buf_ptr - 16);
> -        klv_encode_ber_length(pb, 112 + name_size + (16*track_count) + 12*mxf->store_user_comments); // 20 bytes length for descriptor reference
> +        klv_encode_ber_length(pb, 112 + name_size + (16*track_count) + 12LL*mxf->store_user_comments); // 20 bytes length for descriptor reference
>      }

Obviously OK :)

/Tomas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20151214/184f38b0/attachment.sig>