av_common: fix integer overflow when adjusting timebase

Found by OSS-Fuzz.

Kacper Michajłow committed 2 years ago

Commit 1f7c2231 parent 4d32db21 file · +5 −3Browse files

Unified · Split

common/av_common.c+5−3

@@ -143,12 +143,14 @@ AVRational mp_get_codec_timebase(const struct mp_codec_params *c) · 142 unmodified lines
143	143
144	144	// If the timebase is too coarse, raise its precision, or small adjustments
145	145	// to timestamps done between decoder and demuxer could be lost.
	146	+ int64_t den = tb.den;
146	147	if (av_q2d(tb) > 0.001) {
147		− AVRational r = av_div_q(tb, (AVRational){1, 1000});
148		− tb.den *= (r.num + r.den - 1) / r.den;
	148	+ int64_t scaling_num = tb.num * INT64_C(1000);
	149	+ int64_t scaling_den = tb.den;
	150	+ den *= (scaling_num + scaling_den - 1) / scaling_den;
149	151	}
150	152
151		− av_reduce(&tb.num, &tb.den, tb.num, tb.den, INT_MAX);
	153	+ av_reduce(&tb.num, &tb.den, tb.num, den, INT_MAX);
152	154
153	155	if (tb.num < 1 \|\| tb.den < 1)
154	156	tb = AV_TIME_BASE_Q;