mirror of https://git.ffmpeg.org/ffmpeg.git
avformat/jacosubdec: Use 64bit inside get_shift()
Fixes: signed integer overflow: 111111111 * 30 cannot be represented in type 'int' Fixes: 26448/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5638440374501376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
37396e9ba8
commit
715ff75e5d
|
@ -136,6 +136,7 @@ static int get_shift(int timeres, const char *buf)
|
||||||
{
|
{
|
||||||
int sign = 1;
|
int sign = 1;
|
||||||
int a = 0, b = 0, c = 0, d = 0;
|
int a = 0, b = 0, c = 0, d = 0;
|
||||||
|
int64_t ret;
|
||||||
#define SSEP "%*1[.:]"
|
#define SSEP "%*1[.:]"
|
||||||
int n = sscanf(buf, "%d"SSEP"%d"SSEP"%d"SSEP"%d", &a, &b, &c, &d);
|
int n = sscanf(buf, "%d"SSEP"%d"SSEP"%d"SSEP"%d", &a, &b, &c, &d);
|
||||||
#undef SSEP
|
#undef SSEP
|
||||||
|
@ -145,13 +146,16 @@ static int get_shift(int timeres, const char *buf)
|
||||||
a = FFABS(a);
|
a = FFABS(a);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
ret = 0;
|
||||||
switch (n) {
|
switch (n) {
|
||||||
case 4: return sign * ((a*3600 + b*60 + c) * timeres + d);
|
case 4: ret = sign * (((int64_t)a*3600 + b*60 + c) * timeres + d);
|
||||||
case 3: return sign * (( a*60 + b) * timeres + c);
|
case 3: ret = sign * (( (int64_t)a*60 + b) * timeres + c);
|
||||||
case 2: return sign * (( a) * timeres + b);
|
case 2: ret = sign * (( (int64_t)a) * timeres + b);
|
||||||
}
|
}
|
||||||
|
if ((int)ret != ret)
|
||||||
|
ret = 0;
|
||||||
|
|
||||||
return 0;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int jacosub_read_header(AVFormatContext *s)
|
static int jacosub_read_header(AVFormatContext *s)
|
||||||
|
|
Loading…
Reference in New Issue