string2timecode: don't truncate milliseconds to int

Commit 8c8741fe2000d4b4d89a53f894363a42288cec3e attempted to fix this
expression and make it use the full range of long long, but it missed
the millisecond term.

This fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=522.
The entire timestamp can still overflow long long though.

diff --git a/libass/ass.c b/libass/ass.c
index c35f4ae7df8ad963cd89c36a450832bb1231c426..93376d292d51ee9d175d3c42ed652ccabb39d0c8 100644 (file)
--- a/libass/ass.c
+++ b/libass/ass.c
@@ -232,7 +232,7 @@ static long long string2timecode(ASS_Library *library, char *p)
         ass_msg(library, MSGL_WARN, "Bad timestamp");
         return 0;
     }
-    tm = ((h * 60LL + m) * 60 + s) * 1000 + ms * 10;
+    tm = ((h * 60LL + m) * 60 + s) * 1000 + ms * 10LL;
     return tm;
 }