avformat/mov: Fix signed integer overflows with total_size

Signed integer overflow is undefined behavior. Detected with clang and -fsanitize=signed-integer-overflow

Vitaly Buka committed 9 years ago

Commit 4a404cb1 parent 8c2bb101 file · +1 −1Browse files

Unified · Split

@@ -5572,7 +5572,7 @@ static int mov_read_default(MOVContext c, AVIOContext pb, MOVAtom atom) · 5571 unmodified lines
5572	5572
5573	5573	if (atom.size < 0)
5574	5574	atom.size = INT64_MAX;
5575		− while (total_size + 8 <= atom.size && !avio_feof(pb)) {
	5575	+ while (total_size <= atom.size - 8 && !avio_feof(pb)) {
5576	5576	int (parse)(MOVContext, AVIOContext*, MOVAtom) = NULL;
5577	5577	a.size = atom.size;
5578	5578	a.type=0;

Keyboard shortcuts