diff mbox series

[FFmpeg-devel,2/7] avformat/realtextdec: read_ts() in 64bits

Message ID 20201105231110.7772-2-michael@niedermayer.cc
State Accepted
Commit 47c146a56b5f6641dcf02bbaa056588d5536c582
Headers show
Series [FFmpeg-devel,1/7,RFC] Revert "avcodec/adpcm_swf: support decoding multiple fixed-sized blocks at once"
Related show

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished

Commit Message

Michael Niedermayer Nov. 5, 2020, 11:11 p.m. UTC
Fixes: signed integer overflow: 46671062 * 100 cannot be represented in type 'int'
Fixes: 26826/clusterfuzz-testcase-minimized-ffmpeg_dem_REALTEXT_fuzzer-5644062910316544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/realtextdec.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

Comments

Michael Niedermayer Dec. 6, 2020, 4:33 p.m. UTC | #1
On Fri, Nov 06, 2020 at 12:11:05AM +0100, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 46671062 * 100 cannot be represented in type 'int'
> Fixes: 26826/clusterfuzz-testcase-minimized-ffmpeg_dem_REALTEXT_fuzzer-5644062910316544
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/realtextdec.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)

will apply

[...]
diff mbox series

Patch

diff --git a/libavformat/realtextdec.c b/libavformat/realtextdec.c
index c2316da0ed..390f8ddc67 100644
--- a/libavformat/realtextdec.c
+++ b/libavformat/realtextdec.c
@@ -45,16 +45,16 @@  static int realtext_probe(const AVProbeData *p)
     return !av_strncasecmp(buf, "<window", 7) ? AVPROBE_SCORE_EXTENSION : 0;
 }
 
-static int read_ts(const char *s)
+static int64_t read_ts(const char *s)
 {
     int hh, mm, ss, ms;
 
-    if (sscanf(s, "%u:%u:%u.%u", &hh, &mm, &ss, &ms) == 4) return (hh*3600 + mm*60 + ss) * 100 + ms;
-    if (sscanf(s, "%u:%u:%u"   , &hh, &mm, &ss     ) == 3) return (hh*3600 + mm*60 + ss) * 100;
-    if (sscanf(s,    "%u:%u.%u",      &mm, &ss, &ms) == 3) return (          mm*60 + ss) * 100 + ms;
-    if (sscanf(s,    "%u:%u"   ,      &mm, &ss     ) == 2) return (          mm*60 + ss) * 100;
-    if (sscanf(s,       "%u.%u",           &ss, &ms) == 2) return (                  ss) * 100 + ms;
-    return strtol(s, NULL, 10) * 100;
+    if (sscanf(s, "%u:%u:%u.%u", &hh, &mm, &ss, &ms) == 4) return (hh*3600LL + mm*60LL + ss) * 100LL + ms;
+    if (sscanf(s, "%u:%u:%u"   , &hh, &mm, &ss     ) == 3) return (hh*3600LL + mm*60LL + ss) * 100LL;
+    if (sscanf(s,    "%u:%u.%u",      &mm, &ss, &ms) == 3) return (            mm*60LL + ss) * 100LL + ms;
+    if (sscanf(s,    "%u:%u"   ,      &mm, &ss     ) == 2) return (            mm*60LL + ss) * 100LL;
+    if (sscanf(s,       "%u.%u",           &ss, &ms) == 2) return (                      ss) * 100LL + ms;
+    return strtol(s, NULL, 10) * 100LL;
 }
 
 static int realtext_read_header(AVFormatContext *s)