diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-05-10 23:12:58 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-23 13:15:16 +0200 |
| commit | 2bb39e8af830d1f8b9473752e67c0e6aed358411 (patch) | |
| tree | 4c3a116a16c3a2957eb32970d8b88c04fe8dc695 | |
| parent | ea84fbbf5ea1f3dee634a06d65c3f65fc181940d (diff) | |
| download | ffmpeg-2bb39e8af830d1f8b9473752e67c0e6aed358411.tar.gz | |
avformat/oggparseopus: Check that granule pos is within the supported range
Larger values would imply file durations of astronomic proportions and cause
overflows
Fixes integer overflow
Fixes: usan_int64_overflow
Found-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8efaee3710baa87af40556a622bf2d96a27c6425)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/oggparseopus.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/oggparseopus.c b/libavformat/oggparseopus.c index c8b02fab4d..584fff4538 100644 --- a/libavformat/oggparseopus.c +++ b/libavformat/oggparseopus.c @@ -117,6 +117,10 @@ static int opus_packet(AVFormatContext *avf, int idx) if (!os->psize) return AVERROR_INVALIDDATA; + if (os->granule > INT64_MAX - UINT32_MAX) { + av_log(avf, AV_LOG_ERROR, "Unsupported huge granule pos %"PRId64 "\n", os->granule); + return AVERROR_INVALIDDATA; + } if ((!os->lastpts || os->lastpts == AV_NOPTS_VALUE) && !(os->flags & OGG_FLAG_EOS)) { int seg, d; |