aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat/mov.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2020-10-31 12:01:50 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2020-12-05 00:08:33 +0100
commit7d75ecf8d2d2d05220ca2a3e4177c988b1901774 (patch)
tree094fc877796781c1c0c82b61672a120ca7b8c384 /libavformat/mov.c
parentd7f87a4b9ef18a9846439b7787874cc11e5940de (diff)
downloadffmpeg-7d75ecf8d2d2d05220ca2a3e4177c988b1901774.tar.gz
avformat/mov: Avoid overflow in end computation in mov_read_custom()
Fixes: signed integer overflow: 18 + 9223372036854775799 cannot be represented in type 'long' Fixes: 26731/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5696846019952640 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/mov.c')
-rw-r--r--libavformat/mov.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 175d5a3cc2..ed34130034 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4414,7 +4414,7 @@ static int mov_read_keys(MOVContext *c, AVIOContext *pb, MOVAtom atom)
static int mov_read_custom(MOVContext *c, AVIOContext *pb, MOVAtom atom)
{
- int64_t end = avio_tell(pb) + atom.size;
+ int64_t end = av_sat_add64(avio_tell(pb), atom.size);
uint8_t *key = NULL, *val = NULL, *mean = NULL;
int i;
int ret = 0;