[FFmpeg-devel] [PATCH] Fix integer overflow in mov_read_packet().

[Dale Curtis]

Fixes https://crbug.com/1499669:
runtime error: signed integer overflow: 9223372036853334272 + 1375731456
cannot be represented in type 'int64_t' (aka 'long')

Signed-off-by: Dale Curtis <dalecurtis at chromium.org>
---
 libavformat/mov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 93f202d204..425ddc6849 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -9023,7 +9023,7 @@ static int mov_read_packet(AVFormatContext *s,
AVPacket *pkt)
         pkt->flags |= AV_PKT_FLAG_DISCARD;
     }
     if (sc->ctts_data && sc->ctts_index < sc->ctts_count) {
-        pkt->pts = pkt->dts + sc->dts_shift +
sc->ctts_data[sc->ctts_index].duration;
+        pkt->pts = av_sat_add64(pkt->dts, av_sat_add64(sc->dts_shift,
sc->ctts_data[sc->ctts_index].duration));
         /* update ctts context */
         sc->ctts_sample++;
         if (sc->ctts_index < sc->ctts_count &&
--
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Fix-integer-overflow-in-mov_read_packet.patch
Type: application/octet-stream
Size: 1184 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20231122/36d59aef/attachment.obj>