diff --git a/libavformat/pcm.c b/libavformat/pcm.c index a774dbc372..bea3a1443d 100644 --- a/libavformat/pcm.c +++ b/libavformat/pcm.c @@ -74,7 +74,8 @@ int ff_pcm_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags) { AVStream *st; - int block_align, byte_rate; + int block_align; + int64_t byte_rate; int64_t pos, ret; st = s->streams[0]; @@ -82,9 +83,9 @@ int ff_pcm_read_seek(AVFormatContext *s, block_align = st->codecpar->block_align ? st->codecpar->block_align : (av_get_bits_per_sample(st->codecpar->codec_id) * st->codecpar->ch_layout.nb_channels) >> 3; byte_rate = st->codecpar->bit_rate ? st->codecpar->bit_rate >> 3 : - block_align * st->codecpar->sample_rate; + block_align * (int64_t)st->codecpar->sample_rate; - if (block_align <= 0 || byte_rate <= 0) + if (block_align <= 0 || byte_rate <= 0 || FFMAX(timestamp, st->time_base.num) > INT64_MAX / byte_rate) return -1; if (timestamp < 0) timestamp = 0; @@ -93,6 +94,9 @@ int ff_pcm_read_seek(AVFormatContext *s, st->time_base.num, st->time_base.den * (int64_t)block_align, (flags & AVSEEK_FLAG_BACKWARD) ? AV_ROUND_DOWN : AV_ROUND_UP); + + if (pos > (INT64_MAX - FFMAX(ffformatcontext(s)->data_offset, 0)) / block_align) + return -1; pos *= block_align; /* recompute exact position */