virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

avformat/mpl2dec: Fix integer overflow with duration

Browse Source 
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 23167/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6425051741290496

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9a42a67c5c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-06-08 09:47:41 +02:00
parent e468d9248c
commit d078f39a51
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavformat/mpl2dec.c
View File

@ -55,7 +55,7 @@ static int mpl2_probe(const AVProbeData *p)
return AVPROBE_SCORE_MAX; return AVPROBE_SCORE_MAX;
} }
static int read_ts(char **line, int64_t *pts_start, int *duration) static int read_ts(char **line, int64_t *pts_start, int64_t *duration)
{ {
char c; char c;
int len; int len;
@ -69,7 +69,10 @@ static int read_ts(char **line, int64_t *pts_start, int *duration)
} }
if (sscanf(*line, "[%"SCNd64"][%"SCNd64"]%c%n", if (sscanf(*line, "[%"SCNd64"][%"SCNd64"]%c%n",
pts_start, &end, &c, &len) >= 3) { pts_start, &end, &c, &len) >= 3) {
*duration = end - *pts_start; if (end < *pts_start || end - (uint64_t)*pts_start > INT64_MAX) {
*duration = -1;
} else
*duration = end - *pts_start;
*line += len - 1; *line += len - 1;
return 0; return 0;
} }
@ -97,7 +100,7 @@ static int mpl2_read_header(AVFormatContext *s)
const int64_t pos = avio_tell(s->pb); const int64_t pos = avio_tell(s->pb);
int len = ff_get_line(s->pb, line, sizeof(line)); int len = ff_get_line(s->pb, line, sizeof(line));
int64_t pts_start; int64_t pts_start;
int duration; int64_t duration;
if (!len) if (!len)
break; break;