RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/concatdec: Check user_duration sum 

Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-6434245599690752
Fixes: signed integer overflow: 9223372026773000000 + 22337000000 cannot be represented in type 'long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 007486058c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-03-26 00:16:39 +01:00
parent 45011af5b4
commit dcfc13c199
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/concatdec.c
View File

@ -503,6 +503,8 @@ static int concat_read_header(AVFormatContext *avf)
cat->files[i].user_duration = cat->files[i].outpoint - cat->files[i].inpoint;
}
cat->files[i].duration = cat->files[i].user_duration;
if (time + (uint64_t)cat->files[i].user_duration > INT64_MAX)
return AVERROR_INVALIDDATA;
time += cat->files[i].user_duration;
}
if (i == cat->nb_files) {