diff mbox

[FFmpeg-devel] avfilter/scale: use int64_t for height/width calculation to address overflow

Message ID 20170204180436.78982-1-ffmpeg@tmm1.net
State New
Headers show

Commit Message

Aman Karmani Feb. 4, 2017, 6:04 p.m. UTC 
From: Aman Gupta <aman@tmm1.net>

---
 libavfilter/scale.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Michael Niedermayer Feb. 5, 2017, 2:14 a.m. UTC | #1 
On Sat, Feb 04, 2017 at 10:04:36AM -0800, Aman Gupta wrote:
> From: Aman Gupta <aman@tmm1.net>
> 
> ---
>  libavfilter/scale.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/libavfilter/scale.c b/libavfilter/scale.c
> index 50cd442..9725f1f 100644
> --- a/libavfilter/scale.c
> +++ b/libavfilter/scale.c
> @@ -68,7 +68,7 @@ int ff_scale_eval_dimensions(void *log_ctx,
>      const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(inlink->format);
>      const AVPixFmtDescriptor *out_desc = av_pix_fmt_desc_get(outlink->format);
>      const char *expr;
> -    int w, h;
> +    int64_t w, h;
>      int factor_w, factor_h;
>      int eval_w, eval_h;
>      int ret;
> @@ -138,8 +138,8 @@ int ff_scale_eval_dimensions(void *log_ctx,
>      if (h < 0)
>          h = av_rescale(w, inlink->h, inlink->w * factor_h) * factor_h;
>  
> -    *ret_w = w;
> -    *ret_h = h;
> +    *ret_w = (int)w;
> +    *ret_h = (int)h;

I think the INT_MAX checks should be before casting to int

[...]
diff mbox

Patch

diff --git a/libavfilter/scale.c b/libavfilter/scale.c
index 50cd442..9725f1f 100644
--- a/libavfilter/scale.c
+++ b/libavfilter/scale.c
@@ -68,7 +68,7 @@  int ff_scale_eval_dimensions(void *log_ctx,
     const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(inlink->format);
     const AVPixFmtDescriptor *out_desc = av_pix_fmt_desc_get(outlink->format);
     const char *expr;
-    int w, h;
+    int64_t w, h;
     int factor_w, factor_h;
     int eval_w, eval_h;
     int ret;
@@ -138,8 +138,8 @@  int ff_scale_eval_dimensions(void *log_ctx,
     if (h < 0)
         h = av_rescale(w, inlink->h, inlink->w * factor_h) * factor_h;
 
-    *ret_w = w;
-    *ret_h = h;
+    *ret_w = (int)w;
+    *ret_h = (int)h;
 
     return 0;