diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2023-05-25 22:22:55 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2023-05-29 00:43:39 +0200 |
| commit | 0c78b0dd3b59384a1bebc6bcb89cbca48667cb55 (patch) | |
| tree | 65c4476c281a3be85d7d223cb89268a68e9885a1 /libavformat/mov.c | |
| parent | 6018f8759971c622b77b95c5795e855b35a5684f (diff) | |
| download | ffmpeg-0c78b0dd3b59384a1bebc6bcb89cbca48667cb55.tar.gz | |
avformat/mov: creation time should be non negative
Fixes: signed integer overflow: -9223372036854775808 - 2082844800 cannot be represented in type 'long'
Fixes: 58384/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6428383700713472
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/mov.c')
| -rw-r--r-- | libavformat/mov.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 9fdeef057e..192e460038 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -1521,6 +1521,10 @@ static void mov_metadata_creation_time(MOVContext *c, AVIOContext *pb, AVDiction if (version == 1) { time = avio_rb64(pb); avio_rb64(pb); + if (time < 0) { + av_log(c->fc, AV_LOG_DEBUG, "creation_time is negative\n"); + return; + } } else { time = avio_rb32(pb); avio_rb32(pb); /* modification time */ |