diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-11-05 16:19:18 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-12-06 21:00:03 +0100 |
| commit | 47c146a56b5f6641dcf02bbaa056588d5536c582 (patch) | |
| tree | ce9c3e15d4c7281175479fe297261138cfc7e101 /libavformat/realtextdec.c | |
| parent | 76fbb0052df471075858c1cb82b04c8be7adba8d (diff) | |
| download | ffmpeg-47c146a56b5f6641dcf02bbaa056588d5536c582.tar.gz | |
avformat/realtextdec: read_ts() in 64bits
Fixes: signed integer overflow: 46671062 * 100 cannot be represented in type 'int'
Fixes: 26826/clusterfuzz-testcase-minimized-ffmpeg_dem_REALTEXT_fuzzer-5644062910316544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/realtextdec.c')
| -rw-r--r-- | libavformat/realtextdec.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/libavformat/realtextdec.c b/libavformat/realtextdec.c index c2316da0ed..390f8ddc67 100644 --- a/libavformat/realtextdec.c +++ b/libavformat/realtextdec.c @@ -45,16 +45,16 @@ static int realtext_probe(const AVProbeData *p) return !av_strncasecmp(buf, "<window", 7) ? AVPROBE_SCORE_EXTENSION : 0; } -static int read_ts(const char *s) +static int64_t read_ts(const char *s) { int hh, mm, ss, ms; - if (sscanf(s, "%u:%u:%u.%u", &hh, &mm, &ss, &ms) == 4) return (hh*3600 + mm*60 + ss) * 100 + ms; - if (sscanf(s, "%u:%u:%u" , &hh, &mm, &ss ) == 3) return (hh*3600 + mm*60 + ss) * 100; - if (sscanf(s, "%u:%u.%u", &mm, &ss, &ms) == 3) return ( mm*60 + ss) * 100 + ms; - if (sscanf(s, "%u:%u" , &mm, &ss ) == 2) return ( mm*60 + ss) * 100; - if (sscanf(s, "%u.%u", &ss, &ms) == 2) return ( ss) * 100 + ms; - return strtol(s, NULL, 10) * 100; + if (sscanf(s, "%u:%u:%u.%u", &hh, &mm, &ss, &ms) == 4) return (hh*3600LL + mm*60LL + ss) * 100LL + ms; + if (sscanf(s, "%u:%u:%u" , &hh, &mm, &ss ) == 3) return (hh*3600LL + mm*60LL + ss) * 100LL; + if (sscanf(s, "%u:%u.%u", &mm, &ss, &ms) == 3) return ( mm*60LL + ss) * 100LL + ms; + if (sscanf(s, "%u:%u" , &mm, &ss ) == 2) return ( mm*60LL + ss) * 100LL; + if (sscanf(s, "%u.%u", &ss, &ms) == 2) return ( ss) * 100LL + ms; + return strtol(s, NULL, 10) * 100LL; } static int realtext_read_header(AVFormatContext *s) |