diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-03-20 23:24:40 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-09-26 16:50:42 +0200 |
| commit | d12d83bae94102dada765e5373d9405b87f69c87 (patch) | |
| tree | 6ffabcbf243c3690c733da96d0db575c224afddb /libavformat | |
| parent | 2cbed362aec0837107eeb29528a236eb1b7108d1 (diff) | |
| download | ffmpeg-d12d83bae94102dada765e5373d9405b87f69c87.tar.gz | |
avformat/bfi: Check offsets better
Fixes: signed integer overflow: -2145378272 - 538976288 cannot be represented in type 'int'
Fixes: 45690/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5015496544616448
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 35dc93ab44a57d78956414624c4e011414220e98)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/bfi.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavformat/bfi.c b/libavformat/bfi.c index f9e0bb2e30..35b6816aad 100644 --- a/libavformat/bfi.c +++ b/libavformat/bfi.c @@ -140,12 +140,12 @@ static int bfi_read_packet(AVFormatContext * s, AVPacket * pkt) audio_offset = avio_rl32(pb); avio_rl32(pb); video_offset = avio_rl32(pb); - audio_size = video_offset - audio_offset; - bfi->video_size = chunk_size - video_offset; - if (audio_size < 0 || bfi->video_size < 0) { + if (audio_offset < 0 || video_offset < audio_offset || chunk_size < video_offset) { av_log(s, AV_LOG_ERROR, "Invalid audio/video offsets or chunk size\n"); return AVERROR_INVALIDDATA; } + audio_size = video_offset - audio_offset; + bfi->video_size = chunk_size - video_offset; //Tossing an audio packet at the audio decoder. ret = av_get_packet(pb, pkt, audio_size); |