diff mbox

[FFmpeg-devel,3/5] avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the bitstream and we also have a -1 special case

Message ID 20180722202322.31933-3-michael@niedermayer.cc
State Accepted
Commit 462d1be6dec5ff4768be8c202f359cbf037db3c6
Headers show

Commit Message

Michael Niedermayer July 22, 2018, 8:23 p.m. UTC 
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
Fixes: 9291/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-6324345860259840

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/diracdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox

Patch

diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c
index e4cdd7ee2c..4ef1b3ea9b 100644
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -141,7 +141,7 @@  typedef struct DiracContext {
     GetBitContext gb;
     AVDiracSeqHeader seq;
     int seen_sequence_header;
-    int frame_number;           /* number of the next frame to display       */
+    int64_t frame_number;       /* number of the next frame to display       */
     Plane plane[3];
     int chroma_x_shift;
     int chroma_y_shift;
@@ -2310,7 +2310,7 @@  static int dirac_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     }
 
     if (*got_frame)
-        s->frame_number = picture->display_picture_number + 1;
+        s->frame_number = picture->display_picture_number + 1LL;
 
     return buf_idx;
 }