| Message ID | 20200913174909.32197-1-onemda@gmail.com |
|---|---|
| State | Accepted |
| Commit | 05c8d0bce64888c5312822fbc9cdb63934b86519 |
| Headers | show |
| Series | [FFmpeg-devel] avfilter/avf_concat: check for possible integer overflow | expand |
| Context | Check | Description |
|---|---|---|
| andriy/default | pending | |
| andriy/make | success | Make finished |
| andriy/make_fate | success | Make fate finished |
Paul B Mahol (12020-09-13): > Also check that segment delta pts is always bigger than input pts. > > There is nothing much currently that can be done to recover from > this situation so just return AVERROR_INVALIDDATA error code. Looks ok.
diff --git a/libavfilter/avf_concat.c b/libavfilter/avf_concat.c index 5608ed9ac6..df6414704d 100644 --- a/libavfilter/avf_concat.c +++ b/libavfilter/avf_concat.c @@ -251,6 +251,10 @@ static int send_silence(AVFilterContext *ctx, unsigned in_no, unsigned out_no, if (!rate_tb.den) return AVERROR_BUG; + if (cat->in[in_no].pts < INT64_MIN + seg_delta) + return AVERROR_INVALIDDATA; + if (seg_delta < cat->in[in_no].pts) + return AVERROR_INVALIDDATA; nb_samples = av_rescale_q(seg_delta - cat->in[in_no].pts, outlink->time_base, rate_tb); frame_nb_samples = FFMAX(9600, rate_tb.den / 5); /* arbitrary */
Also check that segment delta pts is always bigger than input pts. There is nothing much currently that can be done to recover from this situation so just return AVERROR_INVALIDDATA error code. Signed-off-by: Paul B Mahol <onemda@gmail.com> --- libavfilter/avf_concat.c | 4 ++++ 1 file changed, 4 insertions(+)