[FFmpeg-devel] [PATCH] avformat/movenc: Check that cts fits in 32bit

[James Almer]

On 3/31/2024 8:40 AM, Michael Niedermayer wrote:
> Fixes: Assertion av_rescale_rnd(start_dts, mov->movie_timescale, track->timescale, AV_ROUND_DOWN) <= 0 failed at libavformat/movenc.c:3694
> Fixes: poc2
> 
> Found-by: Wang Dawei and Zhou Geng, from Zhongguancun Laboratory
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>   libavformat/movenc.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/libavformat/movenc.c b/libavformat/movenc.c
> index ae94d8d5959..5617a2620c5 100644
> --- a/libavformat/movenc.c
> +++ b/libavformat/movenc.c
> @@ -6194,6 +6194,12 @@ int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt)
>       if (ret < 0)
>           return ret;
>   
> +    if (pkt->pts != AV_NOPTS_VALUE &&
> +        (uint64_t)pkt->dts - pkt->pts != (int32_t)((uint64_t)pkt->dts - pkt->pts)) {
> +        av_log(s, AV_LOG_WARNING, "pts/dts pair unsupported\n");
> +        return AVERROR_PATCHWELCOME;
> +    }

Any such check should happen in check_pkt(), called directly above. And 
afaict there's no reason to not support 64bit cts. Even in 
mov_write_edts_tag() we check for it and write a version 1 of the box 
that supports 64bit values.

Maybe the problem is that MOVIentry.cts is an int, when it should be an 
int64_t like start_cts? Can you test the following?

> diff --git a/libavformat/movenc.h b/libavformat/movenc.h
> index 08d580594d..e736c92750 100644
> --- a/libavformat/movenc.h
> +++ b/libavformat/movenc.h
> @@ -49,11 +49,11 @@ typedef struct MOVIentry {
>      uint64_t     pos;
>      int64_t      dts;
>      int64_t      pts;
> +    int64_t      cts;
>      unsigned int size;
>      unsigned int samples_in_chunk;
>      unsigned int chunkNum;              ///< Chunk number if the current entry is a chunk start otherwise 0
>      unsigned int entries;
> -    int          cts;
>  #define MOV_SYNC_SAMPLE         0x0001
>  #define MOV_PARTIAL_SYNC_SAMPLE 0x0002
>  #define MOV_DISPOSABLE_SAMPLE   0x0004