| Message ID | 20210306195140.7082-2-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | f44068db1e12f14e567e46844447aaa78c694b0b |
| Headers | show |
| Series | [FFmpeg-devel,1/2] avcodec/ffwavesynth: Avoid signed integer overflow in phi_at() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
Michael Niedermayer (12021-03-06): > Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long' > Fixes: 31003/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6256298771480576 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/sbgdec.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) No objection. Regards,
On Tue, Mar 23, 2021 at 02:09:55PM +0100, Nicolas George wrote: > Michael Niedermayer (12021-03-06): > > Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long' > > Fixes: 31003/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6256298771480576 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/sbgdec.c | 9 +++++++-- > > 1 file changed, 7 insertions(+), 2 deletions(-) > > No objection. will apply thx [...]
diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c index 64c84c1618..83016d0c13 100644 --- a/libavformat/sbgdec.c +++ b/libavformat/sbgdec.c @@ -891,7 +891,7 @@ fail: return size; } -static void expand_timestamps(void *log, struct sbg_script *s) +static int expand_timestamps(void *log, struct sbg_script *s) { int i, nb_rel = 0; int64_t now, cur_ts, delta = 0; @@ -939,10 +939,13 @@ static void expand_timestamps(void *log, struct sbg_script *s) AV_NOPTS_VALUE; /* may be overridden later by -E option */ cur_ts = now; for (i = 0; i < s->nb_tseq; i++) { + if (av_sat_add64(s->tseq[i].ts.t, delta) != s->tseq[i].ts.t + (uint64_t)delta) + return AVERROR_INVALIDDATA; if (s->tseq[i].ts.t + delta < cur_ts) delta += DAY_TS; cur_ts = s->tseq[i].ts.t += delta; } + return 0; } static int expand_tseq(void *log, struct sbg_script *s, int *nb_ev_max, @@ -995,7 +998,9 @@ static int expand_script(void *log, struct sbg_script *s) { int i, r, nb_events_max = 0; - expand_timestamps(log, s); + r = expand_timestamps(log, s); + if (r < 0) + return r; for (i = 0; i < s->nb_tseq; i++) { r = expand_tseq(log, s, &nb_events_max, 0, &s->tseq[i]); if (r < 0)
Fixes: signed integer overflow: 9223372036854775807 + 86400000000 cannot be represented in type 'long' Fixes: 31003/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6256298771480576 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/sbgdec.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)