diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-12-04 00:30:12 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-02-02 14:18:21 +0100 |
| commit | ef2e673f8f422ac6f87bd9f5a66ce75e28a1e5fe (patch) | |
| tree | 2f363f262517fb2309867181a9729038f7e334b4 | |
| parent | 50ac656fdd9fd41ab1caa645fd5a6cfcd764549a (diff) | |
| download | ffmpeg-ef2e673f8f422ac6f87bd9f5a66ce75e28a1e5fe.tar.gz | |
avformat/dhav: Check position for overflow
Fixes: signed integer overflow: 9223372036854775807 + 32768 cannot be represented in type 'long'
Fixes: 27744/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-5179319491756032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0a0b92b4b2b1288141059684cea741a79cc1e7f2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/dhav.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/dhav.c b/libavformat/dhav.c index 5e9abdb611..faaa1f6177 100644 --- a/libavformat/dhav.c +++ b/libavformat/dhav.c @@ -173,12 +173,12 @@ static int read_chunk(AVFormatContext *s) if (avio_feof(s->pb)) return AVERROR_EOF; - if (avio_rl32(s->pb) != MKTAG('D','H','A','V')) { + if (avio_rl32(s->pb) != MKTAG('D','H','A','V') && dhav->last_good_pos < INT64_MAX - 0x8000) { dhav->last_good_pos += 0x8000; avio_seek(s->pb, dhav->last_good_pos, SEEK_SET); while (avio_rl32(s->pb) != MKTAG('D','H','A','V')) { - if (avio_feof(s->pb)) + if (avio_feof(s->pb) || dhav->last_good_pos >= INT64_MAX - 0x8000) return AVERROR_EOF; dhav->last_good_pos += 0x8000; ret = avio_skip(s->pb, 0x8000 - 4); |