RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/mpeg12dec: Fix integer overflow 

Fixes: signal_sigabrt_7ffff6ac8cc9_686_cov_1897408623_microsoft_new_way_to_shove_mpeg2_in_asf.dvr_ms

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2015-09-02 21:11:07 +02:00
parent d9b56895b5
commit 863522431f
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/mpeg12dec.c
View File

@ -1490,7 +1490,7 @@ static void mpeg_decode_sequence_extension(Mpeg1Context *s1)
s->width |= (horiz_size_ext << 12); s->width |= (horiz_size_ext << 12);
s->height |= (vert_size_ext << 12); s->height |= (vert_size_ext << 12);
bit_rate_ext = get_bits(&s->gb, 12); /* XXX: handle it */ bit_rate_ext = get_bits(&s->gb, 12); /* XXX: handle it */
s->bit_rate += (bit_rate_ext << 18) * 400; s->bit_rate += (bit_rate_ext << 18) * 400LL;
check_marker(&s->gb, "after bit rate extension"); check_marker(&s->gb, "after bit rate extension");
s->avctx->rc_buffer_size += get_bits(&s->gb, 8) * 1024 * 16 << 10; s->avctx->rc_buffer_size += get_bits(&s->gb, 8) * 1024 * 16 << 10;
@ -2175,7 +2175,7 @@ static int mpeg1_decode_sequence(AVCodecContext *avctx,
"frame_rate_index %d is invalid\n", s->frame_rate_index); "frame_rate_index %d is invalid\n", s->frame_rate_index);
s->frame_rate_index = 1; s->frame_rate_index = 1;
} }
s->bit_rate = get_bits(&s->gb, 18) * 400; s->bit_rate = get_bits(&s->gb, 18) * 400LL;
if (check_marker(&s->gb, "in sequence header") == 0) { if (check_marker(&s->gb, "in sequence header") == 0) {
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }