[FFmpeg-devel,3/3] avformat/mpsubdec: Check pts / duration before cast

Submitted by Michael Niedermayer on July 28, 2019, 11:09 p.m.

Details

Message ID 20190728230931.23214-3-michael@niedermayer.cc
State Accepted
Commit 77abf3145344341ec850e05d25a849c6f76fffa5
Headers show

Commit Message

Michael Niedermayer July 28, 2019, 11:09 p.m.
Fixes: 3e+47 is outside the range of representable values of type 'int'
Fixes: 16057/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5691111307214848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mpsubdec.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

Comments

Michael Niedermayer Aug. 23, 2019, 1:42 p.m.
On Mon, Jul 29, 2019 at 01:09:31AM +0200, Michael Niedermayer wrote:
> Fixes: 3e+47 is outside the range of representable values of type 'int'
> Fixes: 16057/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5691111307214848
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/mpsubdec.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)

will apply

[...]

Patch hide | download patch | download mbox

diff --git a/libavformat/mpsubdec.c b/libavformat/mpsubdec.c
index 4ff49ba3cf..a8217a4a61 100644
--- a/libavformat/mpsubdec.c
+++ b/libavformat/mpsubdec.c
@@ -83,13 +83,20 @@  static int mpsub_read_header(AVFormatContext *s)
 
             ff_subtitles_read_chunk(s->pb, &buf);
             if (buf.len) {
+                double ts = current_pts + start*multiplier;
                 sub = ff_subtitles_queue_insert(&mpsub->q, buf.str, buf.len, 0);
                 if (!sub) {
                     res = AVERROR(ENOMEM);
                     goto end;
                 }
-                sub->pts = (int64_t)(current_pts + start*multiplier);
-                sub->duration = (int)(duration * multiplier);
+                if (!isfinite(ts) || ts < INT64_MIN || ts > INT64_MAX) {
+                    avpriv_request_sample(s, "Invalid ts\n");
+                } else
+                    sub->pts = (int64_t)ts;
+                if (!isfinite(duration) || duration * multiplier > INT_MAX || duration < 0) {
+                    avpriv_request_sample(s, "Invalid duration\n");
+                } else
+                    sub->duration = (int)(duration * multiplier);
                 current_pts += (start + duration) * multiplier;
                 sub->pos = pos;
             }