From 17d320800b70a78f4e90cd96564154e829db8b8d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 29 May 2016 03:51:42 +0200 Subject: [PATCH] avformat/movenc: Avoid integer overflow Fixes: CID1361947 Signed-off-by: Michael Niedermayer --- libavformat/movenc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 51c3d2bd6d..f96712435e 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -2454,7 +2454,11 @@ static int mov_write_tkhd_tag(AVIOContext *pb, MOVMuxContext *mov, if (!track_width_1616 || track->height != track->par->height || track_width_1616 > UINT32_MAX) - track_width_1616 = track->par->width * 0x10000U; + track_width_1616 = track->par->width * 0x10000ULL; + if (track_width_1616 > UINT32_MAX) { + av_log(mov->fc, AV_LOG_WARNING, "track width too large\n"); + track_width_1616 = 0; + } avio_wb32(pb, track_width_1616); avio_wb32(pb, track->height * 0x10000U); }