diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-03-06 00:10:05 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-10-06 14:41:41 +0200 |
| commit | c00ad4cc4fc83dc4c0133846206aa1a7658503dd (patch) | |
| tree | 3b8baecbb0f8bbf7ef259046ab41db87d8d7eeb0 | |
| parent | 943c9927458210a7044edd33c4ec48b667a21f09 (diff) | |
| download | ffmpeg-c00ad4cc4fc83dc4c0133846206aa1a7658503dd.tar.gz | |
avformat/sbgdec: Check for overflow in last loop in expand_timestamps()
Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long'
Fixes: 31003/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6256298771480576
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f44068db1e12f14e567e46844447aaa78c694b0b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/sbgdec.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c index d2a5a82c27..ae59c56d5b 100644 --- a/libavformat/sbgdec.c +++ b/libavformat/sbgdec.c @@ -889,7 +889,7 @@ fail: return size; } -static void expand_timestamps(void *log, struct sbg_script *s) +static int expand_timestamps(void *log, struct sbg_script *s) { int i, nb_rel = 0; int64_t now, cur_ts, delta = 0; @@ -937,10 +937,13 @@ static void expand_timestamps(void *log, struct sbg_script *s) AV_NOPTS_VALUE; /* may be overridden later by -E option */ cur_ts = now; for (i = 0; i < s->nb_tseq; i++) { + if (av_sat_add64(s->tseq[i].ts.t, delta) != s->tseq[i].ts.t + (uint64_t)delta) + return AVERROR_INVALIDDATA; if (s->tseq[i].ts.t + delta < cur_ts) delta += DAY_TS; cur_ts = s->tseq[i].ts.t += delta; } + return 0; } static int expand_tseq(void *log, struct sbg_script *s, int *nb_ev_max, @@ -993,7 +996,9 @@ static int expand_script(void *log, struct sbg_script *s) { int i, r, nb_events_max = 0; - expand_timestamps(log, s); + r = expand_timestamps(log, s); + if (r < 0) + return r; for (i = 0; i < s->nb_tseq; i++) { r = expand_tseq(log, s, &nb_events_max, 0, &s->tseq[i]); if (r < 0) |