virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avformat/mov: fix overflow in corrected_dts calculation

Browse Source 
Fixes: Integer-overflow
Fixes: 400093647/clusterfuzz-testcase-minimized-media_metadata_parser_fuzzer-4794341562187776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer
2025-03-01 23:51:25 -03:00
parent 01f63ef0b4
commit 25c439296b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/mov.c
View File

@@ -3539,7 +3539,7 @@ static int mov_read_stts(MOVContext *c, AVIOContext *pb, MOVAtom atom)
av_log(c->fc, AV_LOG_WARNING, "Too large sample offset %u in stts entry %u with count %u in st:%d. Clipping to 1.\n", av_log(c->fc, AV_LOG_WARNING, "Too large sample offset %u in stts entry %u with count %u in st:%d. Clipping to 1.\n",
sample_duration, i, sample_count, st->index); sample_duration, i, sample_count, st->index);
sc->stts_data[i].duration = 1; sc->stts_data[i].duration = 1;
corrected_dts += (delta_magnitude < 0 ? (int64_t)delta_magnitude : 1) * sample_count; corrected_dts = av_sat_add64(corrected_dts, (delta_magnitude < 0 ? (int64_t)delta_magnitude : 1) * sample_count);
} else { } else {
corrected_dts += sample_duration * (uint64_t)sample_count; corrected_dts += sample_duration * (uint64_t)sample_count;
} }