RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

mpeg12dec: avoid signed overflow in bitrate calculation 

CC: libav-stable@libav.org
Bug-Id: 981
Found-By: Agostino Sarubbo
This commit is contained in:
Anton Khirnov 2016-12-17 15:07:51 +01:00
parent 58405de095
commit e807491fc6
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/mpeg12dec.c
View File

@ -1358,8 +1358,17 @@ static void mpeg_decode_sequence_extension(Mpeg1Context *s1)
vert_size_ext = get_bits(&s->gb, 2); vert_size_ext = get_bits(&s->gb, 2);
s->width |= (horiz_size_ext << 12); s->width |= (horiz_size_ext << 12);
s->height |= (vert_size_ext << 12); s->height |= (vert_size_ext << 12);
bit_rate_ext = get_bits(&s->gb, 12); /* XXX: handle it */
s->bit_rate += (bit_rate_ext << 18) * 400; bit_rate_ext = get_bits(&s->gb, 12) << 18;
if (bit_rate_ext < INT_MAX / 400 &&
bit_rate_ext * 400 < INT_MAX - s->bit_rate) {
s->bit_rate += bit_rate_ext * 400;
} else {
av_log(s->avctx, AV_LOG_WARNING, "Invalid bit rate extension value: %d\n",
bit_rate_ext >> 18);
s->bit_rate = 0;
}
skip_bits1(&s->gb); /* marker */ skip_bits1(&s->gb); /* marker */
s->avctx->rc_buffer_size += get_bits(&s->gb, 8) * 1024 * 16 << 10; s->avctx->rc_buffer_size += get_bits(&s->gb, 8) * 1024 * 16 << 10;