@@ -28,6 +28,7 @@
#include <inttypes.h>
#include <limits.h>
#include <stdint.h>
+#include <stdckdint.h>
#include "libavutil/attributes.h"
#include "libavutil/bprint.h"
@@ -3521,15 +3522,15 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
sc->stts_data[i].duration = 1;
corrected_dts += (delta_magnitude < 0 ? (int64_t)delta_magnitude : 1) * sample_count;
} else {
- corrected_dts += sample_duration * (int64_t)sample_count;
+ ckd_add(&corrected_dts, sample_duration * (int64_t)sample_count, corrected_dts);
}
- current_dts += sc->stts_data[i].duration * (int64_t)sample_count;
+ ckd_add(¤t_dts, current_dts, sc->stts_data[i].duration * (int64_t)sample_count);
if (current_dts > corrected_dts) {
int64_t drift = (current_dts - corrected_dts)/FFMAX(sample_count, 1);
uint32_t correction = (sc->stts_data[i].duration > drift) ? drift : sc->stts_data[i].duration - 1;
- current_dts -= correction * (uint64_t)sample_count;
+ ckd_sub(¤t_dts, correction * (int64_t)sample_count, current_dts);
sc->stts_data[i].duration -= correction;
}
Signed-off-by: James Almer <jamrial@gmail.com> --- libavformat/mov.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)