repositories
/
deb_ffmpeg.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Imported Debian version 2.5.0~trusty1.1
[deb_ffmpeg.git]
/
ffmpeg
/
libavformat
/
filmstripdec.c
diff --git
a/ffmpeg/libavformat/filmstripdec.c
b/ffmpeg/libavformat/filmstripdec.c
index abc5f668e8a47f6d073c164834351723bc0a9283..b76d4b7e1d6eed2e4988d120dff24f1fd7447235 100644
(file)
--- a/
ffmpeg/libavformat/filmstripdec.c
+++ b/
ffmpeg/libavformat/filmstripdec.c
@@
-67,6
+67,12
@@
static int read_header(AVFormatContext *s)
st->codec->width = avio_rb16(pb);
st->codec->height = avio_rb16(pb);
film->leading = avio_rb16(pb);
st->codec->width = avio_rb16(pb);
st->codec->height = avio_rb16(pb);
film->leading = avio_rb16(pb);
+
+ if (st->codec->width * 4LL * st->codec->height >= INT_MAX) {
+ av_log(s, AV_LOG_ERROR, "dimensions too large\n");
+ return AVERROR_PATCHWELCOME;
+ }
+
avpriv_set_pts_info(st, 64, 1, avio_rb16(pb));
avio_seek(pb, 0, SEEK_SET);
avpriv_set_pts_info(st, 64, 1, avio_rb16(pb));
avio_seek(pb, 0, SEEK_SET);
@@
-82,9
+88,9
@@
static int read_packet(AVFormatContext *s,
if (avio_feof(s->pb))
return AVERROR(EIO);
if (avio_feof(s->pb))
return AVERROR(EIO);
- pkt->dts = avio_tell(s->pb) / (st->codec->width * (st->codec->height + film->leading) * 4);
+ pkt->dts = avio_tell(s->pb) / (st->codec->width * (
int64_t)(
st->codec->height + film->leading) * 4);
pkt->size = av_get_packet(s->pb, pkt, st->codec->width * st->codec->height * 4);
pkt->size = av_get_packet(s->pb, pkt, st->codec->width * st->codec->height * 4);
- avio_skip(s->pb, st->codec->width * film->leading * 4);
+ avio_skip(s->pb, st->codec->width *
(int64_t)
film->leading * 4);
if (pkt->size < 0)
return pkt->size;
pkt->flags |= AV_PKT_FLAG_KEY;
if (pkt->size < 0)
return pkt->size;
pkt->flags |= AV_PKT_FLAG_KEY;