| Message ID | 20231216121619.19436-4-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | cfc0a68d4d3192779e356a852e71b8218e7a00ab |
| Headers | show |
| Series | [FFmpeg-devel,1/4] tools/target_dec_fuzzer: Adjust Threshold for VP6A | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Sat, Dec 16, 2023 at 01:16:19PM +0100, Michael Niedermayer wrote: > Fixes: signed integer overflow: 2314885530818453536 - -7412889664301817824 cannot be represented in type 'long' > Fixes: 64296/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6304027146846208 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/mov.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) will apply [...]
diff --git a/libavformat/mov.c b/libavformat/mov.c index 30cf7a15b01..65c5c8c288c 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -2242,8 +2242,13 @@ static int mov_read_stco(MOVContext *c, AVIOContext *pb, MOVAtom atom) for (i = 0; i < entries && !pb->eof_reached; i++) sc->chunk_offsets[i] = avio_rb32(pb); else if (atom.type == MKTAG('c','o','6','4')) - for (i = 0; i < entries && !pb->eof_reached; i++) + for (i = 0; i < entries && !pb->eof_reached; i++) { sc->chunk_offsets[i] = avio_rb64(pb); + if (sc->chunk_offsets[i] < 0) { + av_log(c->fc, AV_LOG_WARNING, "Impossible chunk_offset\n"); + sc->chunk_offsets[i] = 0; + } + } else return AVERROR_INVALIDDATA;
Fixes: signed integer overflow: 2314885530818453536 - -7412889664301817824 cannot be represented in type 'long' Fixes: 64296/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6304027146846208 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/mov.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)