[FFmpeg-devel] [PATCH 5/5] avformat/mov: use checked arithmetic functions in mov_read_stts()

[James Almer]

Signed-off-by: James Almer <jamrial at gmail.com>
---
 libavformat/mov.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index a2333ac1fd..bfb6d8d72c 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -28,6 +28,7 @@
 #include <inttypes.h>
 #include <limits.h>
 #include <stdint.h>
+#include <stdckdint.h>
 
 #include "libavutil/attributes.h"
 #include "libavutil/bprint.h"
@@ -3521,15 +3522,15 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
             sc->stts_data[i].duration = 1;
             corrected_dts += (delta_magnitude < 0 ? (int64_t)delta_magnitude : 1) * sample_count;
         } else {
-            corrected_dts += sample_duration * (int64_t)sample_count;
+            ckd_add(&corrected_dts, sample_duration * (int64_t)sample_count, corrected_dts);
         }
 
-        current_dts += sc->stts_data[i].duration * (int64_t)sample_count;
+        ckd_add(&current_dts, current_dts, sc->stts_data[i].duration * (int64_t)sample_count);
 
         if (current_dts > corrected_dts) {
             int64_t drift = (current_dts - corrected_dts)/FFMAX(sample_count, 1);
             uint32_t correction = (sc->stts_data[i].duration > drift) ? drift : sc->stts_data[i].duration - 1;
-            current_dts -= correction * (uint64_t)sample_count;
+            ckd_sub(&current_dts, correction * (int64_t)sample_count, current_dts);
             sc->stts_data[i].duration -= correction;
         }
 
-- 
2.46.1