diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-19 17:13:10 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-10-15 18:44:31 +0200 |
| commit | b7f51428b1c73ab5840485ce537ce098a85d0881 (patch) | |
| tree | 59934ebb6bcacfdf49ea6cdb319662e0cb022980 /libavformat | |
| parent | 0c90377a402d10279a4133034d8dd66c1809d42c (diff) | |
| download | ffmpeg-b7f51428b1c73ab5840485ce537ce098a85d0881.tar.gz | |
avformat/subviewerdec: fail on AV_NOPTS_VALUE
Such values are not supported by ff_subtitles_queue*
Fixes: signed integer overflow: 10 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 24193/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5714901855895552
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/subviewerdec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/subviewerdec.c b/libavformat/subviewerdec.c index fdca3a4820..5c2fe676f1 100644 --- a/libavformat/subviewerdec.c +++ b/libavformat/subviewerdec.c @@ -148,6 +148,10 @@ static int subviewer_read_header(AVFormatContext *s) new_event = 1; pos = avio_tell(s->pb); } else if (*line) { + if (pts_start == AV_NOPTS_VALUE) { + res = AVERROR_INVALIDDATA; + goto end; + } if (!new_event) { sub = ff_subtitles_queue_insert(&subviewer->q, "\n", 1, 1); if (!sub) { |