Message ID | 20201015203232.18258-3-michael@niedermayer.cc |
---|---|
State | Accepted |
Commit | 0d088a47ca0243576078f109fff20617d1fac382 |
Headers | show |
Series | [FFmpeg-devel,1/5] avcodec/notchlc: Check uncompressed size against input for LZ4 | expand |
Context | Check | Description |
---|---|---|
andriy/x86_make | success | Make finished |
andriy/x86_make_fate | success | Make fate finished |
On Thu, Oct 15, 2020 at 10:32:30PM +0200, Michael Niedermayer wrote: > Fixes: signed integer overflow: -1172299744 * 2 cannot be represented in type 'int' > Fixes: 26258/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5672758488596480 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> will apply [...]
diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index 103155e9e7..ff9107d73f 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -769,6 +769,8 @@ static int asf_read_marker(AVFormatContext *s, int64_t size) avio_rl32(pb); // send time avio_rl32(pb); // flags name_len = avio_rl32(pb); // name length + if ((unsigned)name_len > INT_MAX / 2) + return AVERROR_INVALIDDATA; if ((ret = avio_get_str16le(pb, name_len * 2, name, sizeof(name))) < name_len) avio_skip(pb, name_len - ret);
Fixes: signed integer overflow: -1172299744 * 2 cannot be represented in type 'int' Fixes: 26258/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5672758488596480 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/asfdec_f.c | 2 ++ 1 file changed, 2 insertions(+)