Fixes: Integer-overflow Fixes: 400093647/clusterfuzz-testcase-minimized-media_metadata_parser_fuzzer-4794341562187776
Unified · Split
| @@ -3539,7 +3539,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom) · 3538 unmodified lines | ||
| 3539 | 3539 | av_log(c->fc, AV_LOG_WARNING, "Too large sample offset %u in stts entry %u with count %u in st:%d. Clipping to 1.\n", |
| 3540 | 3540 | sample_duration, i, sample_count, st->index); |
| 3541 | 3541 | sc->stts_data[i].duration = 1; |
| 3542 | − corrected_dts += (delta_magnitude < 0 ? (int64_t)delta_magnitude : 1) * sample_count; | |
| 3542 | + corrected_dts = av_sat_add64(corrected_dts, (delta_magnitude < 0 ? (int64_t)delta_magnitude : 1) * sample_count); | |
| 3543 | 3543 | } else { |
| 3544 | 3544 | corrected_dts += sample_duration * (uint64_t)sample_count; |
| 3545 | 3545 | } |