diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-07-28 23:05:45 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-23 22:26:50 +0200 |
| commit | 77abf3145344341ec850e05d25a849c6f76fffa5 (patch) | |
| tree | 77ef902181c7c104cbe6616a1264596ada0c5031 /libavformat/mpsubdec.c | |
| parent | 4d4734bdc881de3af0ebe5935890a81423c80fdf (diff) | |
| download | ffmpeg-77abf3145344341ec850e05d25a849c6f76fffa5.tar.gz | |
avformat/mpsubdec: Check pts / duration before cast
Fixes: 3e+47 is outside the range of representable values of type 'int'
Fixes: 16057/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5691111307214848
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/mpsubdec.c')
| -rw-r--r-- | libavformat/mpsubdec.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/libavformat/mpsubdec.c b/libavformat/mpsubdec.c index 4ff49ba3cf..a8217a4a61 100644 --- a/libavformat/mpsubdec.c +++ b/libavformat/mpsubdec.c @@ -83,13 +83,20 @@ static int mpsub_read_header(AVFormatContext *s) ff_subtitles_read_chunk(s->pb, &buf); if (buf.len) { + double ts = current_pts + start*multiplier; sub = ff_subtitles_queue_insert(&mpsub->q, buf.str, buf.len, 0); if (!sub) { res = AVERROR(ENOMEM); goto end; } - sub->pts = (int64_t)(current_pts + start*multiplier); - sub->duration = (int)(duration * multiplier); + if (!isfinite(ts) || ts < INT64_MIN || ts > INT64_MAX) { + avpriv_request_sample(s, "Invalid ts\n"); + } else + sub->pts = (int64_t)ts; + if (!isfinite(duration) || duration * multiplier > INT_MAX || duration < 0) { + avpriv_request_sample(s, "Invalid duration\n"); + } else + sub->duration = (int)(duration * multiplier); current_pts += (start + duration) * multiplier; sub->pos = pos; } |