ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-09-19 21:06:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/matroskadec: Check prebuffered_ns for overflow

Browse Source 
Fixes: signed integer overflow: 9223372036630775808 + 1000000000 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-5406131992526848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d6df3719d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-09-30 23:44:25 +02:00
parent af121ad20d
commit 6d95339161
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/matroskadec.c
View File

@ -4030,13 +4030,17 @@ static int64_t webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t
int64_t prebuffer_ns = 1000000000;
int64_t time_ns = st->index_entries[i].timestamp * matroska->time_scale;
double nano_seconds_per_second = 1000000000.0;
int64_t prebuffered_ns = time_ns + prebuffer_ns;
int64_t prebuffered_ns;
double prebuffer_bytes = 0.0;
int64_t temp_prebuffer_ns = prebuffer_ns;
int64_t pre_bytes, pre_ns;
double pre_sec, prebuffer, bits_per_second;
CueDesc desc_beg = get_cue_desc(s, time_ns, cues_start);
if (time_ns > INT64_MAX - prebuffer_ns)
return -1;
prebuffered_ns = time_ns + prebuffer_ns;
// Start with the first Cue.
CueDesc desc_end = desc_beg;