diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-05-10 23:12:58 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-06-05 02:40:30 +0200 |
| commit | 46360e36d928d0856ce818adbec9d9545c4c5559 (patch) | |
| tree | b28333c28775b6f8ba1f03de0be9a31c575e7aa8 | |
| parent | ef2b8416d95647c39634ddb2dcf2aa1bcbe9292a (diff) | |
| download | ffmpeg-46360e36d928d0856ce818adbec9d9545c4c5559.tar.gz | |
avformat/oggparseopus: Check that granule pos is within the supported range
Larger values would imply file durations of astronomic proportions and cause
overflows
Fixes integer overflow
Fixes: usan_int64_overflow
Found-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8efaee3710baa87af40556a622bf2d96a27c6425)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/oggparseopus.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/oggparseopus.c b/libavformat/oggparseopus.c index c8b02fab4d..584fff4538 100644 --- a/libavformat/oggparseopus.c +++ b/libavformat/oggparseopus.c @@ -117,6 +117,10 @@ static int opus_packet(AVFormatContext *avf, int idx) if (!os->psize) return AVERROR_INVALIDDATA; + if (os->granule > INT64_MAX - UINT32_MAX) { + av_log(avf, AV_LOG_ERROR, "Unsupported huge granule pos %"PRId64 "\n", os->granule); + return AVERROR_INVALIDDATA; + } if ((!os->lastpts || os->lastpts == AV_NOPTS_VALUE) && !(os->flags & OGG_FLAG_EOS)) { int seg, d; |