summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2022-03-20 23:24:40 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2022-10-09 22:15:35 +0200
commit0487f8e95e5f1e90d12729db4c16392970b4b3ca (patch)
treef0086b9eed1e1000bdb0410660dee40aa1e70984
parent12794ff1e49bc409f668484840b721871ab9bca6 (diff)
downloadffmpeg-0487f8e95e5f1e90d12729db4c16392970b4b3ca.tar.gz
avformat/bfi: Check offsets better
Fixes: signed integer overflow: -2145378272 - 538976288 cannot be represented in type 'int' Fixes: 45690/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5015496544616448 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 35dc93ab44a57d78956414624c4e011414220e98) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavformat/bfi.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/libavformat/bfi.c b/libavformat/bfi.c
index f32a2cf8ce..a226101f76 100644
--- a/libavformat/bfi.c
+++ b/libavformat/bfi.c
@@ -143,12 +143,12 @@ static int bfi_read_packet(AVFormatContext * s, AVPacket * pkt)
audio_offset = avio_rl32(pb);
avio_rl32(pb);
video_offset = avio_rl32(pb);
- audio_size = video_offset - audio_offset;
- bfi->video_size = chunk_size - video_offset;
- if (audio_size < 0 || bfi->video_size < 0) {
+ if (audio_offset < 0 || video_offset < audio_offset || chunk_size < video_offset) {
av_log(s, AV_LOG_ERROR, "Invalid audio/video offsets or chunk size\n");
return AVERROR_INVALIDDATA;
}
+ audio_size = video_offset - audio_offset;
+ bfi->video_size = chunk_size - video_offset;
//Tossing an audio packet at the audio decoder.
ret = av_get_packet(pb, pkt, audio_size);