diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-01-17 22:10:02 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-02-02 13:12:12 +0100 |
| commit | 92b194919199e6ea978ff6e120e9f9034b2bd299 (patch) | |
| tree | 5bd8fc41907f0dd6ce37cf7f816e7c6fad873f37 /libavformat/sccdec.c | |
| parent | 2a0d17c4d1f7f5539b8bbad90cca1eab45780982 (diff) | |
| download | ffmpeg-92b194919199e6ea978ff6e120e9f9034b2bd299.tar.gz | |
avformat/sccdec: Use larger intermediate for ts/next_ts computation
Fixes: signed integer overflow: 92237203 * 33 cannot be represented in type 'int'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SCC_fuzzer-6603769487949824
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/sccdec.c')
| -rw-r--r-- | libavformat/sccdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/sccdec.c b/libavformat/sccdec.c index 751dee7c6c..1786520944 100644 --- a/libavformat/sccdec.c +++ b/libavformat/sccdec.c @@ -93,7 +93,7 @@ static int scc_read_header(AVFormatContext *s) break; } - ts = (hh * 3600LL + mm * 60LL + ss) * 1000LL + fs * 33; + ts = (hh * 3600LL + mm * 60LL + ss) * 1000LL + fs * 33LL; while (!ff_text_eof(&tr)) { len = ff_subtitles_read_line(&tr, line2, sizeof(line2)); @@ -117,7 +117,7 @@ static int scc_read_header(AVFormatContext *s) } } - next_ts = (hh * 3600LL + mm * 60LL + ss) * 1000LL + fs * 33; + next_ts = (hh * 3600LL + mm * 60LL + ss) * 1000LL + fs * 33LL; pos = ff_text_pos(&tr); lline = (char *)&line; |