diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-06-16 23:02:11 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-06-23 22:03:02 +0200 |
| commit | d8ee01425459aaafe36acc7743b3f9f28a01821b (patch) | |
| tree | c2568b9ae5855a0e4f88ebbf8c95c83e909c70a5 /libavformat | |
| parent | 38bc24be8d366dbf832fa1a2a4a89901de981067 (diff) | |
| download | ffmpeg-d8ee01425459aaafe36acc7743b3f9f28a01821b.tar.gz | |
avformat/hls: Limit start_seq_no to one bit less
This avoids overflow checks on additions with 32bit numbers
Fixes: signed integer overflow: 9223372036854775806 + 2 cannot be represented in type 'long'
Fixes: 44012/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-4747770734444544
Fixes: 48065/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-5372410355908608
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/hls.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavformat/hls.c b/libavformat/hls.c index 8204f55df3..b736f093a9 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -837,10 +837,10 @@ static int parse_playlist(HLSContext *c, const char *url, if (ret < 0) goto fail; seq_no = strtoull(ptr, NULL, 10); - if (seq_no > INT64_MAX) { + if (seq_no > INT64_MAX/2) { av_log(c->ctx, AV_LOG_DEBUG, "MEDIA-SEQUENCE higher than " - "INT64_MAX, mask out the highest bit\n"); - seq_no &= INT64_MAX; + "INT64_MAX/2, mask out the highest bit\n"); + seq_no &= INT64_MAX/2; } pls->start_seq_no = seq_no; } else if (av_strstart(line, "#EXT-X-PLAYLIST-TYPE:", &ptr)) { |