Protect values against integer overflow (#743)

When the code multiplies integer values in an rvalue context before
it's stored in a larger type, the on-the-fly math is stored as int.
The value can overflow before it reaches the wider memory space.

To prevent this, we explicitly cast the result of the arithmetic
to the destination type.

Issues flagged by GitHub CodeQL.
This commit is contained in:
Frank Dana
2021-09-27 20:36:56 -04:00
committed by GitHub
parent e2e3a54c02
commit 3d18347e71
4 changed files with 35 additions and 15 deletions

View File

@@ -1535,7 +1535,13 @@ void FFmpegReader::ProcessAudioPacket(int64_t requested_frame, int64_t target_fr
audio_frame->nb_samples); // number of input samples to convert
// Copy audio samples over original samples
memcpy(audio_buf, audio_converted->data[0], audio_converted->nb_samples * av_get_bytes_per_sample(AV_SAMPLE_FMT_S16) * info.channels);
memcpy(audio_buf,
audio_converted->data[0],
static_cast<size_t>(
audio_converted->nb_samples
* av_get_bytes_per_sample(AV_SAMPLE_FMT_S16)
* info.channels)
);
// Deallocate resample buffer
SWR_CLOSE(avr);