aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2020-12-24 20:42:27 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2021-01-28 21:06:48 +0100
commit78d6d8ddb571ecca54616517defbf894a45ea9c3 (patch)
tree568c98a6d6bb63b35dec0be2ab90e41bd2350cbb /libavformat
parented51890191d660829eef2d1eef802da957b7fef0 (diff)
downloadffmpeg-78d6d8ddb571ecca54616517defbf894a45ea9c3.tar.gz
avformat/mpc8: Check size before implicitly converting to int
Fixes: Timeout Fixes: 28551/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-6229183210586112 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
-rw-r--r--libavformat/mpc8.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mpc8.c b/libavformat/mpc8.c
index 447a8d4fdf..ff7da2ef55 100644
--- a/libavformat/mpc8.c
+++ b/libavformat/mpc8.c
@@ -292,7 +292,7 @@ static int mpc8_read_packet(AVFormatContext *s, AVPacket *pkt)
return AVERROR_EOF;
mpc8_get_chunk_header(s->pb, &tag, &size);
- if (size < 0)
+ if (size < 0 || size > INT_MAX)
return -1;
if(tag == TAG_AUDIOPACKET){
if ((ret = av_get_packet(s->pb, pkt, size)) < 0)