RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/dts2pts_bsf: Eliminate some 64bit corner cases 

Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 53364/clusterfuzz-testcase-minimized-ffmpeg_BSF_DTS2PTS_fuzzer-4693772269387776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-11-21 23:59:49 +01:00
parent aa79560de5
commit 5185d5656b
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/dts2pts_bsf.c
View File

@ -301,15 +301,15 @@ static int h264_filter(AVBSFContext *ctx)
if (output_picture_number != h264->last_poc) { if (output_picture_number != h264->last_poc) {
if (h264->last_poc != INT_MIN) { if (h264->last_poc != INT_MIN) {
int diff = FFABS(h264->last_poc - output_picture_number); int64_t diff = FFABS(h264->last_poc - (int64_t)output_picture_number);
if ((output_picture_number < 0) && !h264->last_poc) if ((output_picture_number < 0) && !h264->last_poc)
h264->poc_diff = 0; h264->poc_diff = 0;
else if (FFABS(output_picture_number) < h264->poc_diff) { else if (FFABS((int64_t)output_picture_number) < h264->poc_diff) {
diff = FFABS(output_picture_number); diff = FFABS(output_picture_number);
h264->poc_diff = 0; h264->poc_diff = 0;
} }
if (!h264->poc_diff || (h264->poc_diff > diff)) { if ((!h264->poc_diff || (h264->poc_diff > diff)) && diff <= INT_MAX) {
h264->poc_diff = diff; h264->poc_diff = diff;
if (h264->poc_diff == 1 && h264->sps.frame_mbs_only_flag) { if (h264->poc_diff == 1 && h264->sps.frame_mbs_only_flag) {
av_tree_enumerate(s->root, &h264->poc_diff, NULL, dec_poc); av_tree_enumerate(s->root, &h264->poc_diff, NULL, dec_poc);