Re: [FFmpeg-devel] [PATCH] Fix integer overflow in mov_read_packet().

From: Michael Niedermayer <michael@niedermayer.cc>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Subject: Re: [FFmpeg-devel] [PATCH] Fix integer overflow in mov_read_packet().
Date: Sat, 2 Dec 2023 00:24:22 +0100
Message-ID: <20231201232422.GS3543730@pb2> (raw)
In-Reply-To: <CAPUDrwfu3MbnNkLPHpXyCQTVD1z5nEnZo9n+EHNCs+MQrv5bvg@mail.gmail.com>

[-- Attachment #1.1: Type: text/plain, Size: 1901 bytes --]

On Fri, Dec 01, 2023 at 10:52:21AM -0800, Dale Curtis wrote:
> On Fri, Nov 24, 2023 at 3:38 PM Michael Niedermayer <michael@niedermayer.cc>
> wrote:
> 
> > On Wed, Nov 22, 2023 at 02:20:59PM -0800, Dale Curtis wrote:
> > > Fixes https://crbug.com/1499669:
> >
> > > runtime error: signed integer overflow: 9223372036853334272 + 1375731456
> >
> > this looks a bit close to AV_NOPTS_VALUE but its not actually that close
> >
> 
> Yes I originally thought the same thing!
> 
> 
> >
> >
> > > cannot be represented in type 'int64_t' (aka 'long')
> > >
> > > Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
> > > ---
> > >  libavformat/mov.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/libavformat/mov.c b/libavformat/mov.c
> > > index 93f202d204..425ddc6849 100644
> > > --- a/libavformat/mov.c
> > > +++ b/libavformat/mov.c
> > > @@ -9023,7 +9023,7 @@ static int mov_read_packet(AVFormatContext *s,
> > AVPacket *pkt)
> > >          pkt->flags |= AV_PKT_FLAG_DISCARD;
> > >      }
> > >      if (sc->ctts_data && sc->ctts_index < sc->ctts_count) {
> > > -        pkt->pts = pkt->dts + sc->dts_shift +
> > sc->ctts_data[sc->ctts_index].duration;
> > > +        pkt->pts = av_sat_add64(pkt->dts, av_sat_add64(sc->dts_shift,
> > sc->ctts_data[sc->ctts_index].duration));
> > >          /* update ctts context */
> > >          sc->ctts_sample++;
> > >          if (sc->ctts_index < sc->ctts_count &&
> >
> > This is probably ok
> > alternatively pts could be set to AV_NOPTS_VALUE if its unrepresentable
> >
> 
> I defer to you. Either is fine with me. Let me know if you'd like me to
> change it.

ill apply the original patch

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Opposition brings concord. Out of discord comes the fairest harmony.
-- Heraclitus

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".