| Message ID | 20210112215116.21186-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 0bee216ad454dd7238a03dd9a76428cc6c3233cc |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
On Tue, Jan 12, 2021 at 10:51:13PM +0100, Michael Niedermayer wrote: > Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long' > Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800 > > Alternatively this could be ignored but then the end condition of the loop > would be hard to reach as avio_tell() is int64_t > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/asfdec_o.c | 3 +++ > 1 file changed, 3 insertions(+) will apply [...]
On Tue, Jan 12, 2021 at 10:51:13PM +0100, Michael Niedermayer wrote: > Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long' > Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800 > > Alternatively this could be ignored but then the end condition of the loop > would be hard to reach as avio_tell() is int64_t > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/asfdec_o.c | 3 +++ > 1 file changed, 3 insertions(+) will apply rest of this patchset [...]
diff --git a/libavformat/asfdec_o.c b/libavformat/asfdec_o.c index 655ba9f9ef..6ce5a3fb43 100644 --- a/libavformat/asfdec_o.c +++ b/libavformat/asfdec_o.c @@ -1661,6 +1661,9 @@ static int detect_unknown_subobject(AVFormatContext *s, int64_t offset, int64_t ff_asf_guid guid; int ret; + if (offset > INT64_MAX - size) + return AVERROR_INVALIDDATA; + while (avio_tell(pb) <= offset + size) { if (avio_tell(pb) == asf->offset) break;
Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long' Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800 Alternatively this could be ignored but then the end condition of the loop would be hard to reach as avio_tell() is int64_t Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/asfdec_o.c | 3 +++ 1 file changed, 3 insertions(+)