From 7df3b426bbfbd7efd9a0f56393e3cc78413b0869 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tomas=20H=C3=A4rdin?= <tomas.hardin@codemill.se>
Date: Fri, 24 Oct 2014 00:05:59 +0100
Subject: [PATCH] mxfenc: Fix possible integer overflows
None of these are likely unless the user is writing a file with two billion
streams or a duration of around two months.
CC: libav-stable@libav.org
Bug-Id: CID 700568 / CID 700569 / CID 700570 /
CID 700571 / CID 700572 / CID 700573
---
libavformat/mxfenc.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/libavformat/mxfenc.c b/libavformat/mxfenc.c
index 841e7277911..ea7a4bbf934 100644
--- a/libavformat/mxfenc.c
+++ b/libavformat/mxfenc.c
@@ -447,7 +447,7 @@ static void mxf_write_preface(AVFormatContext *s)
mxf_write_metadata_key(pb, 0x012f00);
PRINT_KEY(s, "preface key", pb->buf_ptr - 16);
- klv_encode_ber_length(pb, 130 + 16 * mxf->essence_container_count);
+ klv_encode_ber_length(pb, 130 + 16LL * mxf->essence_container_count);
// write preface set uid
mxf_write_local_tag(pb, 16, 0x3C0A);
@@ -720,7 +720,7 @@ static void mxf_write_multi_descriptor(AVFormatContext *s)
mxf_write_metadata_key(pb, 0x014400);
PRINT_KEY(s, "multiple descriptor key", pb->buf_ptr - 16);
- klv_encode_ber_length(pb, 64 + 16 * s->nb_streams);
+ klv_encode_ber_length(pb, 64 + 16LL * s->nb_streams);
mxf_write_local_tag(pb, 16, 0x3C0A);
mxf_write_uuid(pb, MultipleDescriptor, 0);
@@ -1053,8 +1053,8 @@ static void mxf_write_index_table_segment(AVFormatContext *s)
if (mxf->edit_unit_byte_count) {
klv_encode_ber_length(pb, 80);
} else {
- klv_encode_ber_length(pb, 85 + 12+(s->nb_streams+1)*6 +
- 12+mxf->edit_units_count*(11+mxf->slice_count*4));
+ klv_encode_ber_length(pb, 85 + 12+(s->nb_streams+1LL)*6 +
+ 12+mxf->edit_units_count*(11+mxf->slice_count*4LL));
}
// instance id
@@ -1216,7 +1216,7 @@ static int mxf_write_partition(AVFormatContext *s, int bodysid,
// write klv
avio_write(pb, key, 16);
- klv_encode_ber_length(pb, 88 + 16 * mxf->essence_container_count);
+ klv_encode_ber_length(pb, 88 + 16LL * mxf->essence_container_count);
// write partition value
avio_wb16(pb, 1); // majorVersion
@@ -1761,7 +1761,7 @@ static void mxf_write_random_index_pack(AVFormatContext *s)
int i;
avio_write(pb, random_index_pack_key, 16);
- klv_encode_ber_length(pb, 28 + 12*mxf->body_partitions_count);
+ klv_encode_ber_length(pb, 28 + 12LL*mxf->body_partitions_count);
if (mxf->edit_unit_byte_count)
avio_wb32(pb, 1); // BodySID of header partition
--
GitLab