diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-06-08 09:47:41 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-05 12:43:08 +0200 |
| commit | 60568d284161c1e666d73d5462aaa8e4de1fa40d (patch) | |
| tree | 0de640d8ca2c61c1bb9fc16abd987a72fda4f31e /libavformat | |
| parent | a1cfe7baede40a61fee8c0e6021e6e7283586f77 (diff) | |
| download | ffmpeg-60568d284161c1e666d73d5462aaa8e4de1fa40d.tar.gz | |
avformat/mpl2dec: Fix integer overflow with duration
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 23167/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6425051741290496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9a42a67c5ca198a3879b7f3663cc44ccbcaf0bd3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/mpl2dec.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/libavformat/mpl2dec.c b/libavformat/mpl2dec.c index 260b7be0ec..8805e1e692 100644 --- a/libavformat/mpl2dec.c +++ b/libavformat/mpl2dec.c @@ -50,7 +50,7 @@ static int mpl2_probe(AVProbeData *p) return AVPROBE_SCORE_MAX; } -static int read_ts(char **line, int64_t *pts_start, int *duration) +static int read_ts(char **line, int64_t *pts_start, int64_t *duration) { char c; int len; @@ -64,7 +64,10 @@ static int read_ts(char **line, int64_t *pts_start, int *duration) } if (sscanf(*line, "[%"SCNd64"][%"SCNd64"]%c%n", pts_start, &end, &c, &len) >= 3) { - *duration = end - *pts_start; + if (end < *pts_start || end - (uint64_t)*pts_start > INT64_MAX) { + *duration = -1; + } else + *duration = end - *pts_start; *line += len - 1; return 0; } @@ -89,7 +92,7 @@ static int mpl2_read_header(AVFormatContext *s) const int64_t pos = avio_tell(s->pb); int len = ff_get_line(s->pb, line, sizeof(line)); int64_t pts_start; - int duration; + int64_t duration; if (!len) break; |