diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-05-10 23:12:58 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-05-11 00:32:32 +0200 |
| commit | 8efaee3710baa87af40556a622bf2d96a27c6425 (patch) | |
| tree | 82737823a307e39817056a99c3ee023baa8afe85 /libavformat/oggparseopus.c | |
| parent | aeefe018f847aa46c8d69d1d237a54ef89f58fee (diff) | |
| download | ffmpeg-8efaee3710baa87af40556a622bf2d96a27c6425.tar.gz | |
avformat/oggparseopus: Check that granule pos is within the supported range
Larger values would imply file durations of astronomic proportions and cause
overflows
Fixes integer overflow
Fixes: usan_int64_overflow
Found-by: Thomas Guilbert <tguilbert@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/oggparseopus.c')
| -rw-r--r-- | libavformat/oggparseopus.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/oggparseopus.c b/libavformat/oggparseopus.c index 8191b1083c..99aa4398dd 100644 --- a/libavformat/oggparseopus.c +++ b/libavformat/oggparseopus.c @@ -117,6 +117,10 @@ static int opus_packet(AVFormatContext *avf, int idx) if (!os->psize) return AVERROR_INVALIDDATA; + if (os->granule > INT64_MAX - UINT32_MAX) { + av_log(avf, AV_LOG_ERROR, "Unsupported huge granule pos %"PRId64 "\n", os->granule); + return AVERROR_INVALIDDATA; + } if ((!os->lastpts || os->lastpts == AV_NOPTS_VALUE) && !(os->flags & OGG_FLAG_EOS)) { int seg, d; |