diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-04-28 16:53:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-09-08 21:31:50 +0200 |
| commit | da9e84fabd0285204df60a032e0846fe70be0068 (patch) | |
| tree | 618f6994240b0ea4953c04cd7d69bbf0d37d54e8 | |
| parent | 890a801468c1ec615ea4dfc667053f9ac571ea95 (diff) | |
| download | ffmpeg-da9e84fabd0285204df60a032e0846fe70be0068.tar.gz | |
avformat/mov: Fix incorrect overflow detection in mov_read_sidx()
Fixes: signed integer overflow: 9223372036854775807 + 1442840321 cannot be represented in type 'long'
Fixes: 33670/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6644379491106816
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 200406d930eff3202f3230f188f85f4ab9cf4525)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/mov.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 56c538cf63..b49dd01543 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -5132,7 +5132,7 @@ static int mov_read_sidx(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (frag_stream_info) frag_stream_info->sidx_pts = timestamp; - if (av_sat_add64(offset, size) != offset + size || + if (av_sat_add64(offset, size) != offset + (uint64_t)size || av_sat_add64(pts, duration) != pts + (uint64_t)duration ) return AVERROR_INVALIDDATA; |