avfilter/avf_concat: check for possible integer overflow

Also check that segment delta pts is always bigger than input pts.

There is nothing much currently that can be done to recover from
this situation so just return AVERROR_INVALIDDATA error code.

diff --git a/libavfilter/avf_concat.c b/libavfilter/avf_concat.c
index 5608ed9ac61525569c349f3b2cd7919c266755c9..df6414704d05d8760773bb54a0ca85d1a4679f65 100644 (file)
--- a/libavfilter/avf_concat.c
+++ b/libavfilter/avf_concat.c
@@ -251,6 +251,10 @@ static int send_silence(AVFilterContext *ctx, unsigned in_no, unsigned out_no,
 
     if (!rate_tb.den)
         return AVERROR_BUG;
+    if (cat->in[in_no].pts < INT64_MIN + seg_delta)
+        return AVERROR_INVALIDDATA;
+    if (seg_delta < cat->in[in_no].pts)
+        return AVERROR_INVALIDDATA;
     nb_samples = av_rescale_q(seg_delta - cat->in[in_no].pts,
                               outlink->time_base, rate_tb);
     frame_nb_samples = FFMAX(9600, rate_tb.den / 5); /* arbitrary */