[FFmpeg-cvslog] lavf: avoid integer overflow in ff_compute_frame_duration()

[Janne Grunau]

ffmpeg | branch: master | Janne Grunau <janne-libav at jannau.net> | Fri Nov 23 14:05:36 2012 +0100| [7709ce029a7bc101b9ac1ceee607cda10dcb89dc] | committer: Janne Grunau

lavf: avoid integer overflow in ff_compute_frame_duration()

Scaling the denominator instead of the numerator if it is too large
loses precision. Fixes an assert caused by a negative frame duration in
the fuzzed sample nasa-8s2.ts_s202310.

CC: libav-stable at libav.org

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7709ce029a7bc101b9ac1ceee607cda10dcb89dc
---

 libavformat/utils.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavformat/utils.c b/libavformat/utils.c
index ca52469..fc8b770 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -725,7 +725,10 @@ void ff_compute_frame_duration(int *pnum, int *pden, AVStream *st,
             *pnum = st->codec->time_base.num;
             *pden = st->codec->time_base.den;
             if (pc && pc->repeat_pict) {
-                *pnum = (*pnum) * (1 + pc->repeat_pict);
+                if (*pnum > INT_MAX / (1 + pc->repeat_pict))
+                    *pden /= 1 + pc->repeat_pict;
+                else
+                    *pnum *= 1 + pc->repeat_pict;
             }
             //If this codec can be interlaced or progressive then we need a parser to compute duration of a packet
             //Thus if we have no parser in such case leave duration undefined.