diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-04-01 12:46:08 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-06-25 21:36:32 +0200 |
| commit | e6cad01122c6dea0435d042d68a56045a214492d (patch) | |
| tree | df3fa45be44215ae373ff6572adb57478440278d | |
| parent | 59a58d1a85611c65c9f6910c75ee5bfa7ba43364 (diff) | |
| download | ffmpeg-e6cad01122c6dea0435d042d68a56045a214492d.tar.gz | |
avformat/matroskadec: avoid integer overflows in SAR computation
This ignores >64bit
Alternatively we could support that if it occurs in reality
Fixes: negation of -9223372036854775808
Fixes: integer overflows
Fixes: 46072/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5029840966778880
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/matroskadec.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index cd30b5f7a4..73ded761fd 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -2886,11 +2886,14 @@ static int matroska_parse_tracks(AVFormatContext *s) mkv_stereo_mode_display_mul(track->video.stereo_mode, &display_width_mul, &display_height_mul); if (track->video.display_unit < MATROSKA_VIDEO_DISPLAYUNIT_UNKNOWN) { - av_reduce(&st->sample_aspect_ratio.num, - &st->sample_aspect_ratio.den, - st->codecpar->height * track->video.display_width * display_width_mul, - st->codecpar->width * track->video.display_height * display_height_mul, - INT_MAX); + if (track->video.display_width && track->video.display_height && + st->codecpar->height < INT64_MAX / track->video.display_width / display_width_mul && + st->codecpar->width < INT64_MAX / track->video.display_height / display_height_mul) + av_reduce(&st->sample_aspect_ratio.num, + &st->sample_aspect_ratio.den, + st->codecpar->height * track->video.display_width * display_width_mul, + st->codecpar->width * track->video.display_height * display_height_mul, + INT_MAX); } if (st->codecpar->codec_id != AV_CODEC_ID_HEVC) sti->need_parsing = AVSTREAM_PARSE_HEADERS; |