virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

avformat/mpsubdec: Check pts / duration before cast

Browse Source 
Fixes: 3e+47 is outside the range of representable values of type 'int'
Fixes: 16057/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5691111307214848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-07-28 23:05:45 +02:00
parent 4d4734bdc8
commit 77abf31453
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavformat/mpsubdec.c
View File

@ -83,13 +83,20 @@ static int mpsub_read_header(AVFormatContext *s)
ff_subtitles_read_chunk(s->pb, &buf);
if (buf.len) {
double ts = current_pts + start*multiplier;
sub = ff_subtitles_queue_insert(&mpsub->q, buf.str, buf.len, 0);
if (!sub) {
res = AVERROR(ENOMEM);
goto end;
}
sub->pts = (int64_t)(current_pts + start*multiplier);
sub->duration = (int)(duration * multiplier);
if (!isfinite(ts) || ts < INT64_MIN || ts > INT64_MAX) {
avpriv_request_sample(s, "Invalid ts\n");
} else
sub->pts = (int64_t)ts;
if (!isfinite(duration) || duration * multiplier > INT_MAX || duration < 0) {
avpriv_request_sample(s, "Invalid duration\n");
} else
sub->duration = (int)(duration * multiplier);
current_pts += (start + duration) * multiplier;
sub->pos = pos;
}