diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-03-26 00:36:40 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-03-26 23:25:39 +0100 |
| commit | 878625812f164fbb733f442965235656d9eaccc8 (patch) | |
| tree | 5a3eb46f8ee867175db1ee4f5ecf78e3c0d0f8f5 /libavformat | |
| parent | 3d8d778a68531b406455f8090d81216ef374ab75 (diff) | |
| download | ffmpeg-878625812f164fbb733f442965235656d9eaccc8.tar.gz | |
avformat/rpl: Use 64bit for total_audio_size and check it
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4677434693517312
Fixes: signed integer overflow: 5555555555555555556 * 8 cannot be represented in type 'long long'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rpl.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/rpl.c b/libavformat/rpl.c index 3f10e51d48..09d0b68f74 100644 --- a/libavformat/rpl.c +++ b/libavformat/rpl.c @@ -118,7 +118,7 @@ static int rpl_read_header(AVFormatContext *s) AVIOContext *pb = s->pb; RPLContext *rpl = s->priv_data; AVStream *vst = NULL, *ast = NULL; - int total_audio_size; + int64_t total_audio_size; int error = 0; const char *endptr; char audio_type[RPL_LINE_LENGTH]; @@ -303,6 +303,8 @@ static int rpl_read_header(AVFormatContext *s) if (ast) av_add_index_entry(ast, offset + video_size, total_audio_size, audio_size, audio_size * 8, 0); + if (total_audio_size/8 + (uint64_t)audio_size >= INT64_MAX/8) + return AVERROR_INVALIDDATA; total_audio_size += audio_size * 8; } |