Skip to content

Commit

Permalink
Mp4: fixed potential overflow in ngx_http_mp4_crop_stts_data().
Browse files Browse the repository at this point in the history
Both "count" and "duration" variables are 32-bit, so their product might
potentially overflow.  It is used to reduce 64-bit start_time variable,
and with very large start_time this can result in incorrect seeking.

Found by Coverity (CID 1499904).
  • Loading branch information
mdounin committed Jun 7, 2022
1 parent f08dbef commit 80fc2dd
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/http/modules/ngx_http_mp4_module.c
Original file line number Diff line number Diff line change
Expand Up @@ -2331,7 +2331,7 @@ ngx_http_mp4_crop_stts_data(ngx_http_mp4_file_t *mp4,
}

start_sample += count;
start_time -= count * duration;
start_time -= (uint64_t) count * duration;
entries--;
entry++;
}
Expand Down

0 comments on commit 80fc2dd

Please sign in to comment.