RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/fits: Check gcount and pcount being non negative 

Fixes: signed integer overflow: 9223372036854775807 - -30069403896 cannot be represented in type 'long'
Fixes: 30046/clusterfuzz-testcase-minimized-ffmpeg_dem_FITS_fuzzer-5807144773484544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c000a91288)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2021-02-02 19:28:15 +01:00
parent 245b7cd4c9
commit 3b6a33b660
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/fits.c
View File

@ -205,8 +205,12 @@ int avpriv_fits_header_parse_line(void *avcl, FITSHeader *header, const uint8_t
} else if (!strcmp(keyword, "GROUPS") && sscanf(value, "%c", &c) == 1) {
header->groups = (c == 'T');
} else if (!strcmp(keyword, "GCOUNT") && sscanf(value, "%"SCNd64"", &t) == 1) {
if (t < 0 || t > INT_MAX)
return AVERROR_INVALIDDATA;
header->gcount = t;
} else if (!strcmp(keyword, "PCOUNT") && sscanf(value, "%"SCNd64"", &t) == 1) {
if (t < 0 || t > INT_MAX)
return AVERROR_INVALIDDATA;
header->pcount = t;
}
dict_set_if_not_null(metadata, keyword, value);