diff mbox series

[FFmpeg-devel,8/9] avformat/mov: Use 64bit in intermediate for current_dts

Message ID 20240603021526.2372698-8-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/9] avdevice/xcbgrab: Check sscanf() return | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer June 3, 2024, 2:15 a.m. UTC
Fixes: CID1500304 Unintentional integer overflow
Fixes: CID1500318 Unintentional integer overflow

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mov.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 45eca74d1db..d15b7b70c50 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -3389,12 +3389,12 @@  static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
             corrected_dts += sample_duration * sample_count;
         }
 
-        current_dts += sc->stts_data[i].duration * sample_count;
+        current_dts += sc->stts_data[i].duration * (int64_t)sample_count;
 
         if (current_dts > corrected_dts) {
             int64_t drift = (current_dts - corrected_dts)/FFMAX(sample_count, 1);
             uint32_t correction = (sc->stts_data[i].duration > drift) ? drift : sc->stts_data[i].duration - 1;
-            current_dts -= correction * sample_count;
+            current_dts -= correction * (uint64_t)sample_count;
             sc->stts_data[i].duration -= correction;
         }