highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/mpeg4videoenc: Use 64bit for time variables

Browse Source 
Fixes assertion failure and integer overflow
Fixes: fc677bbea2c6f901763eb637b61fa5e2/signal_sigabrt_7ffff6ae7cb7_9556_dfd95f040a69f725d1b2f861bd491725.ivf

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2016-01-23 01:49:21 +01:00
parent 15cc98a0f3
commit f502583663
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/mpeg4videoenc.c
View File

@ -1088,8 +1088,8 @@ static void mpeg4_encode_vol_header(MpegEncContext *s,
/* write mpeg4 VOP header */ /* write mpeg4 VOP header */
int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number) int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
{ {
int time_incr; uint64_t time_incr;
int time_div, time_mod; int64_t time_div, time_mod;
if (s->pict_type == AV_PICTURE_TYPE_I) { if (s->pict_type == AV_PICTURE_TYPE_I) {
if (!(s->avctx->flags & AV_CODEC_FLAG_GLOBAL_HEADER)) { if (!(s->avctx->flags & AV_CODEC_FLAG_GLOBAL_HEADER)) {
@ -1111,11 +1111,10 @@ int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
time_div = FFUDIV(s->time, s->avctx->time_base.den); time_div = FFUDIV(s->time, s->avctx->time_base.den);
time_mod = FFUMOD(s->time, s->avctx->time_base.den); time_mod = FFUMOD(s->time, s->avctx->time_base.den);
time_incr = time_div - s->last_time_base; time_incr = time_div - s->last_time_base;
av_assert0(time_incr >= 0);
// This limits the frame duration to max 1 hour // This limits the frame duration to max 1 hour
if (time_incr > 3600) { if (time_incr > 3600) {
av_log(s->avctx, AV_LOG_ERROR, "time_incr %d too large\n", time_incr); av_log(s->avctx, AV_LOG_ERROR, "time_incr %"PRIu64" too large\n", time_incr);
return AVERROR(EINVAL); return AVERROR(EINVAL);
} }
while (time_incr--) while (time_incr--)