avformat/avidec: Fix integer overflow in cum_len check

Fixes: signed integer overflow: 3775922176 * 4278190080 cannot be represented in type 'long' Fixes: Chromium bug 791237 Reported-by: Matt Wolenetz <[email protected]> Reviewed-by: Matt Wolenetz <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]>
SaschaVasarrhelyi · Mar 10, 2018 · 06e092e · 06e092e
1 parent 02ecda4
commit 06e092e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/libavformat/avidec.c b/libavformat/avidec.c
@@ -670,7 +670,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
             st->start_time = 0;
             avio_rl32(pb); /* buffer size */
             avio_rl32(pb); /* quality */
-            if (ast->cum_len*ast->scale/ast->rate > 3600) {
+            if (ast->cum_len > 3600LL * ast->rate / ast->scale) {
                 av_log(s, AV_LOG_ERROR, "crazy start time, iam scared, giving up\n");
                 ast->cum_len = 0;
             }