signed integer overflow encoding ffv1

[Suhwan]

Summary of the bug:
There is a signed integer overflow at libavcodec/put_bits.h:56

I compiled ffmpeg with "--toolchain=clang-usan" to check the undefined-behaviours and attached log file.
How to reproduce:

% ffmpeg_g -y -r 62 -i $PoC -loglevel 0 -vbsf mov2textsub -c ffv1 tmp.mjpeg

ffmpeg version N-95604-g881f083a16 Copyright (c) 2000-2019 the FFmpeg developers
built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-usan

Here's UBSAN log

libavcodec/put_bits.h:56:25: runtime error: signed integer overflow: 8 * 296117757 cannot be represented in type 'int'

Thread 1 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() ()
(gdb) bt
#0  0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() ()
#1  0x000000000042b0eb in void handleIntegerOverflowImpl<__ubsan::Value>(__ubsan::OverflowData*, unsigned long, char const*, __ubsan::Value, __ubsan::ReportOptions) ()
#2  0x000000000042c9df in __ubsan_handle_mul_overflow ()
#3  0x00000000020c93f7 in init_put_bits (s=<optimized out>, buffer=0x7fff7dfe3043 "", buffer_size=296117757) at libavcodec/put_bits.h:56
#4  encode_slice (c=0x9416480, arg=<optimized out>) at libavcodec/ffv1enc.c:1078
#5  0x0000000002ed372a in worker_func (priv=0x9416480, jobnr=0, threadnr=<optimized out>, nb_jobs=<optimized out>, nb_threads=<optimized out>)
    at libavcodec/pthread_slice.c:71
#6  0x0000000005a0d108 in run_jobs (ctx=0x976cc40) at libavutil/slicethread.c:61
#7  0x0000000005a0cdbf in avpriv_slicethread_execute (ctx=<optimized out>, nb_jobs=<optimized out>, execute_main=0) at libavutil/slicethread.c:188
#8  0x0000000002ed2a4d in thread_execute (avctx=<optimized out>, func=<optimized out>, arg=<optimized out>, ret=<optimized out>, job_count=<optimized out>, 
    job_size=<optimized out>) at libavcodec/pthread_slice.c:110
#9  0x00000000020bf7fe in encode_frame (avctx=0x9416480, pkt=0x976c840, pict=0x9778040, got_packet=0x7fffffffc284) at libavcodec/ffv1enc.c:1233
#10 0x000000000200739f in avcodec_encode_video2 (avctx=0x9416480, avpkt=<optimized out>, frame=<optimized out>, got_packet_ptr=0x7fffffffc284) at libavcodec/encode.c:302
#11 0x00000000020090d0 in do_encode (avctx=0x9416480, frame=0x9778040, got_packet=0x7fffffffc284) at libavcodec/encode.c:371
#12 0x0000000002008c4a in avcodec_send_frame (avctx=0x9416480, frame=0x9778040) at libavcodec/encode.c:420
#13 0x00000000004c5228 in do_video_out (of=0x9403cc0, ost=<optimized out>, next_picture=<optimized out>, sync_ipts=4.9406564584124654e-324) at fftools/ffmpeg.c:1288
#14 0x00000000004c0f5b in reap_filters (flush=0) at fftools/ffmpeg.c:1505
#15 0x000000000048d6b2 in transcode_step () at fftools/ffmpeg.c:4639
#16 transcode () at fftools/ffmpeg.c:4683
#17 0x0000000000487dc4 in main (argc=13, argv=<optimized out>) at fftools/ffmpeg.c:4885

Please confirm.
Thanks

[Suhwan]

poc

[mkver]

Fixed in e7cbbd90267de2a0ad1b5fa8ccb29ab7bf8a26b8.