diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-19 17:13:10 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-10-09 22:02:19 +0200 |
| commit | 3f13007d5c1befab7182a0db50ac180f4d231036 (patch) | |
| tree | 2c1bfbed6484ea55cef814a6a364447efc3d97e8 | |
| parent | d7d8a8ccfb4295f91e03f211fcef2537aadeaea1 (diff) | |
| download | ffmpeg-3f13007d5c1befab7182a0db50ac180f4d231036.tar.gz | |
avformat/subviewerdec: fail on AV_NOPTS_VALUE
Such values are not supported by ff_subtitles_queue*
Fixes: signed integer overflow: 10 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 24193/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5714901855895552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b7f51428b1c73ab5840485ce537ce098a85d0881)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/subviewerdec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/subviewerdec.c b/libavformat/subviewerdec.c index e8d1eb6c96..19a39f227f 100644 --- a/libavformat/subviewerdec.c +++ b/libavformat/subviewerdec.c @@ -132,6 +132,10 @@ static int subviewer_read_header(AVFormatContext *s) new_event = 1; pos = avio_tell(s->pb); } else if (*line) { + if (pts_start == AV_NOPTS_VALUE) { + res = AVERROR_INVALIDDATA; + goto end; + } if (!new_event) { sub = ff_subtitles_queue_insert(&subviewer->q, "\n", 1, 1); if (!sub) { |