| Message ID | 20200719174218.30659-5-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | b7f51428b1c73ab5840485ce537ce098a85d0881 |
| Headers | show |
| Series | [FFmpeg-devel,1/6] avformat/wc3movie: Move wc3_read_close() up | expand |
| Context | Check | Description |
|---|---|---|
| andriy/default | pending | |
| andriy/make | success | Make finished |
| andriy/make_fate | success | Make fate finished |
On Sun, Jul 19, 2020 at 07:42:17PM +0200, Michael Niedermayer wrote: > Such values are not supported by ff_subtitles_queue* > > Fixes: signed integer overflow: 10 - -9223372036854775808 cannot be represented in type 'long' > Fixes: 24193/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5714901855895552 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/subviewerdec.c | 4 ++++ > 1 file changed, 4 insertions(+) will apply [...]
diff --git a/libavformat/subviewerdec.c b/libavformat/subviewerdec.c index fdca3a4820..5c2fe676f1 100644 --- a/libavformat/subviewerdec.c +++ b/libavformat/subviewerdec.c @@ -148,6 +148,10 @@ static int subviewer_read_header(AVFormatContext *s) new_event = 1; pos = avio_tell(s->pb); } else if (*line) { + if (pts_start == AV_NOPTS_VALUE) { + res = AVERROR_INVALIDDATA; + goto end; + } if (!new_event) { sub = ff_subtitles_queue_insert(&subviewer->q, "\n", 1, 1); if (!sub) {
Such values are not supported by ff_subtitles_queue* Fixes: signed integer overflow: 10 - -9223372036854775808 cannot be represented in type 'long' Fixes: 24193/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5714901855895552 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/subviewerdec.c | 4 ++++ 1 file changed, 4 insertions(+)