diff mbox series

[FFmpeg-devel] avfilter/avf_concat: check for possible integer overflow

Message ID 20200913174909.32197-1-onemda@gmail.com
State Accepted
Commit 05c8d0bce64888c5312822fbc9cdb63934b86519
Headers show
Series [FFmpeg-devel] avfilter/avf_concat: check for possible integer overflow
Related show

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

Paul B Mahol Sept. 13, 2020, 5:49 p.m. UTC
Also check that segment delta pts is always bigger than input pts.

There is nothing much currently that can be done to recover from
this situation so just return AVERROR_INVALIDDATA error code.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavfilter/avf_concat.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Nicolas George Sept. 14, 2020, 9:44 a.m. UTC | #1
Paul B Mahol (12020-09-13):
> Also check that segment delta pts is always bigger than input pts.
> 
> There is nothing much currently that can be done to recover from
> this situation so just return AVERROR_INVALIDDATA error code.

Looks ok.
diff mbox series

Patch

diff --git a/libavfilter/avf_concat.c b/libavfilter/avf_concat.c
index 5608ed9ac6..df6414704d 100644
--- a/libavfilter/avf_concat.c
+++ b/libavfilter/avf_concat.c
@@ -251,6 +251,10 @@  static int send_silence(AVFilterContext *ctx, unsigned in_no, unsigned out_no,
 
     if (!rate_tb.den)
         return AVERROR_BUG;
+    if (cat->in[in_no].pts < INT64_MIN + seg_delta)
+        return AVERROR_INVALIDDATA;
+    if (seg_delta < cat->in[in_no].pts)
+        return AVERROR_INVALIDDATA;
     nb_samples = av_rescale_q(seg_delta - cat->in[in_no].pts,
                               outlink->time_base, rate_tb);
     frame_nb_samples = FFMAX(9600, rate_tb.den / 5); /* arbitrary */