diff mbox

[FFmpeg-devel] avformat/mov: Fix potential integer overflow in entry check in mov_read_trun()

Message ID 20190317103440.24355-1-michael@niedermayer.cc
State Accepted
Commit ff13a92a6f8413402f5b3cacedda7c10d350b487
Headers show

Commit Message

Michael Niedermayer March 17, 2019, 10:34 a.m. UTC 
No testcase

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Michael Niedermayer March 25, 2019, 1:58 p.m. UTC | #1 
On Sun, Mar 17, 2019 at 11:34:40AM +0100, Michael Niedermayer wrote:
> No testcase
> 
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/mov.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

will apply

[...]
diff mbox

Patch

diff --git a/libavformat/mov.c b/libavformat/mov.c
index a7d444b0ee..ff9a9cbc95 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4778,7 +4778,7 @@  static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     av_log(c->fc, AV_LOG_TRACE, "first sample flags 0x%x\n", first_sample_flags);
 
     // realloc space for new index entries
-    if((unsigned)st->nb_index_entries + entries >= UINT_MAX / sizeof(AVIndexEntry)) {
+    if((uint64_t)st->nb_index_entries + entries >= UINT_MAX / sizeof(AVIndexEntry)) {
         entries = UINT_MAX / sizeof(AVIndexEntry) - st->nb_index_entries;
         av_log(c->fc, AV_LOG_ERROR, "Failed to add index entry\n");
     }