diff mbox series

[FFmpeg-devel,4/5] avformat/bfi: Check offsets better

Message ID 20220320233056.18169-4-michael@niedermayer.cc
State Accepted
Commit 35dc93ab44a57d78956414624c4e011414220e98
Headers show
Series [FFmpeg-devel,1/5] avformat/hls: Check target_duration | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished

Commit Message

Michael Niedermayer March 20, 2022, 11:30 p.m. UTC 
Fixes: signed integer overflow: -2145378272 - 538976288 cannot be represented in type 'int'
Fixes: 45690/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5015496544616448

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/bfi.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Michael Niedermayer June 9, 2022, 6:53 p.m. UTC | #1 
On Mon, Mar 21, 2022 at 12:30:55AM +0100, Michael Niedermayer wrote:
> Fixes: signed integer overflow: -2145378272 - 538976288 cannot be represented in type 'int'
> Fixes: 45690/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5015496544616448
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/bfi.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)

will apply

[...]
diff mbox series

Patch

diff --git a/libavformat/bfi.c b/libavformat/bfi.c
index a42b78b8c0..dcbe21dcae 100644
--- a/libavformat/bfi.c
+++ b/libavformat/bfi.c
@@ -139,12 +139,12 @@  static int bfi_read_packet(AVFormatContext * s, AVPacket * pkt)
         audio_offset    = avio_rl32(pb);
         avio_rl32(pb);
         video_offset    = avio_rl32(pb);
-        audio_size      = video_offset - audio_offset;
-        bfi->video_size = chunk_size - video_offset;
-        if (audio_size < 0 || bfi->video_size < 0) {
+        if (audio_offset < 0 || video_offset < audio_offset || chunk_size < video_offset) {
             av_log(s, AV_LOG_ERROR, "Invalid audio/video offsets or chunk size\n");
             return AVERROR_INVALIDDATA;
         }
+        audio_size      = video_offset - audio_offset;
+        bfi->video_size = chunk_size - video_offset;
 
         //Tossing an audio packet at the audio decoder.
         ret = av_get_packet(pb, pkt, audio_size);