RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/mov: Avoid undefined overflow in time_offset calculation 

Fixes: signed integer overflow: 8511838621821575200 - -3954125146725285889 cannot be represented in type 'long'
Fixes: 33414/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6610119325515776

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7666d588ba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2021-04-20 17:40:56 +02:00
parent 3a5dc113ef
commit 8c2ba20612
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/mov.c
View File

@ -3822,7 +3822,11 @@ static void mov_build_index(MOVContext *mov, AVStream *st)
if ((empty_duration || start_time) && mov->time_scale > 0) { if ((empty_duration || start_time) && mov->time_scale > 0) {
if (empty_duration) if (empty_duration)
empty_duration = av_rescale(empty_duration, sc->time_scale, mov->time_scale); empty_duration = av_rescale(empty_duration, sc->time_scale, mov->time_scale);
sc->time_offset = start_time - empty_duration;
if (av_sat_sub64(start_time, empty_duration) != start_time - (uint64_t)empty_duration)
av_log(mov->fc, AV_LOG_WARNING, "start_time - empty_duration is not representable\n");
sc->time_offset = start_time - (uint64_t)empty_duration;
sc->min_corrected_pts = start_time; sc->min_corrected_pts = start_time;
if (!mov->advanced_editlist) if (!mov->advanced_editlist)
current_dts = -sc->time_offset; current_dts = -sc->time_offset;