virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

tiff: fix overflows when calling av_reduce

Browse Source 
The arguments of av_reduce are signed, so the cast to uint64_t is misleading.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2016-12-13 00:43:21 +01:00
parent 076c3a9fa2
commit ed412d2850
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/tiff.c
View File

@ -772,9 +772,18 @@ static void set_sar(TiffContext *s, unsigned tag, unsigned num, unsigned den)
int offset = tag == TIFF_YRES ? 2 : 0;
s->res[offset++] = num;
s->res[offset] = den;
if (s->res[0] && s->res[1] && s->res[2] && s->res[3])
if (s->res[0] && s->res[1] && s->res[2] && s->res[3]) {
uint64_t num = s->res[2] * (uint64_t)s->res[1];
uint64_t den = s->res[0] * (uint64_t)s->res[3];
if (num > INT64_MAX || den > INT64_MAX) {
num = num >> 1;
den = den >> 1;
}
av_reduce(&s->avctx->sample_aspect_ratio.num, &s->avctx->sample_aspect_ratio.den,
s->res[2] * (uint64_t)s->res[1], s->res[0] * (uint64_t)s->res[3], INT32_MAX);
num, den, INT32_MAX);
if (!s->avctx->sample_aspect_ratio.den)
s->avctx->sample_aspect_ratio = (AVRational) {0, 1};
}
}
static int tiff_decode_tag(TiffContext *s, AVFrame *frame)