diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-12-01 03:53:42 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2025-01-08 23:23:25 +0100 |
| commit | f7cc023f06c42fce8652b8d8f8cf981d36aeed2e (patch) | |
| tree | 46600ae3a95a2fe575119dea43b284555dbdfee9 | |
| parent | 4bd9b5f52057915033a0cefeb9749ea99c301c6a (diff) | |
| download | ffmpeg-f7cc023f06c42fce8652b8d8f8cf981d36aeed2e.tar.gz | |
avformat/mxfdec: Check edit_unit for being larger than signed 64bit
Fixes: signed integer overflow: 2 * -4962931467012268000 cannot be represented in type 'long'
Fixes: 376496313/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4921469185884160
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/mxfdec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 1bae523c2a..02db8d4cb3 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -1928,6 +1928,8 @@ static int mxf_edit_unit_absolute_offset(MXFContext *mxf, MXFIndexTable *index_t // clamp to actual range of index index_end = av_sat_add64(last_segment->index_start_position, last_segment->index_duration); edit_unit = FFMAX(FFMIN(edit_unit, index_end), first_segment->index_start_position); + if (edit_unit < 0) + return AVERROR_PATCHWELCOME; // guess which table segment this edit unit is in // saturation is fine since it's just a guess |