From patchwork Tue Dec 26 16:37:31 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 45333 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a20:6623:b0:194:e134:edd4 with SMTP id n35csp3137575pzh; Tue, 26 Dec 2023 08:38:01 -0800 (PST) X-Google-Smtp-Source: AGHT+IGPYmtqEKj28SxeGoBJlMK67rYqFW/6WacdwxyEz7/FfrmXl13WO49RfamGPvSRhdEq2r7T X-Received: by 2002:a17:906:d189:b0:a23:58f9:e1d0 with SMTP id c9-20020a170906d18900b00a2358f9e1d0mr7784666ejz.2.1703608681590; Tue, 26 Dec 2023 08:38:01 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1703608681; cv=none; d=google.com; s=arc-20160816; b=MUPxTzZ3CoMgWPAmZpZgvhVBiNqqpxfXxn6qgrX1c+TuzfKo+OzIWxhkvE2O6x2/Zh BIKbnVnSb2KP0zebd/xHya6yqkrHluYX7ayOCe997P7AniCXEPt69BHaHWbN/H221EFs sNie5Olf8TkrJF2GqDzsDgGz3QU6bPjmFqDwTINpGJJE3kfjtNMA1ZVoF0gweYYniL7F 2uH0SjkuRdevpAHnol6yUJxlSFNDmyAheOhm6Ub+sZPv34QSPOR6UB8T3pw3PWTKWwAv R1EDRCgJ7CpJY/q3dKw8muRD+zpbPVY05Y3QF/b6N69HsWMOcb93CmQR5G1x+QbjIl6U p2UQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:dkim-signature:delivered-to; bh=GsAcV9ehjiW9hXDspEKapBbPoOBl6ja3INW5GzWROwY=; fh=e5zN9xSzcxLA6bGo3lF+CqTbY/oLwzApV03EO/RBfgQ=; b=zYhyCp1Iawgl4FsagbjtSHwpbNoWKhxFUnpPs2IDKgzHbCRtgv3cnr5HLaFkwgUylw WrqLxJ1qXDbRim6yT4WPg03+hosCE8umP3d12tXRad00M37auhNnkoV8IyFv4gCqJZLk ems1hYihBxkgIgn1hY9gncQ4ODHAmNLQjbe/c9n7f3TnpOCMFMgL3/MI9IPPi4KmajY5 LVvj3QaodqIOIkYa3nNIvclUs65IfVQKXtzO1/TEgdSKCCZ04ftg9sqyN0jiN+BA6aIe 6722RUB9Vbpx57+MQMBjLhI56HLpC4Ax0VdcHjkVCCudmEfTx1Q5lXLOrZ42rtmTyFIT NB1g== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=bDEGLJCS; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id kb4-20020a170907924400b00a26ab41d1bfsi2741573ejb.120.2023.12.26.08.38.00; Tue, 26 Dec 2023 08:38:01 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@niedermayer.cc header.s=gm1 header.b=bDEGLJCS; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id BD5A268CCB4; Tue, 26 Dec 2023 18:37:43 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from relay8-d.mail.gandi.net (relay8-d.mail.gandi.net [217.70.183.201]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C596768CC6C for ; Tue, 26 Dec 2023 18:37:34 +0200 (EET) Received: by mail.gandi.net (Postfix) with ESMTPSA id EB0491BF206 for ; Tue, 26 Dec 2023 16:37:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1703608654; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:in-reply-to:in-reply-to:references:references; bh=xwkRJRs6Y8PwpLt3cmScrumn33iCYGN57OuvxpUJyHA=; b=bDEGLJCS52N7Vn8IF4G3pkhDRy6b1z62IyI64fg06z771DM+39WAsDo+KdV6dpZWLnI8SA YbvbwFmQpk52qho8C7vQLDnqcl/7zWdTF16igfYFiKTC6wc0KdtS2LqM6QCxi+63Yk7hds 6Mf/RgpMaC2WVsEhLp8rj5Pq8I52WDR6VuFRWhagLWdPRVQANdT/932OYurMbenFAayzzd n/vZVBFiwL9DmQV1JJsXclzIk5q8kPnftWLcNNpTUyRiBaJn8qr9UVZWzVJ5vhHPeSEp7N o7kcUefG3JLdA79ch/cdby73hBHyA3HEnxfvCAuUL5FHkYlO4o5aN3nCVr8qVQ== From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Tue, 26 Dec 2023 17:37:31 +0100 Message-Id: <20231226163731.4147-3-michael@niedermayer.cc> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20231226163731.4147-1-michael@niedermayer.cc> References: <20231226163731.4147-1-michael@niedermayer.cc> X-GND-Sasl: michael@niedermayer.cc Subject: [FFmpeg-devel] [PATCH 3/3] avformat/concatdec: clip outpoint - inpoint overflow in get_best_effort_duration() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: E4kiG1QBPQmc An alternative would be to limit all time/duration fields to below 64bit Fixes: signed integer overflow: -93000000 - 9223372036839000000 cannot be represented in type 'long long' Fixes: 64546/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-5110813828186112 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/concatdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/concatdec.c b/libavformat/concatdec.c index 5a7a063ef7d..3da2ac9e705 100644 --- a/libavformat/concatdec.c +++ b/libavformat/concatdec.c @@ -323,7 +323,7 @@ static int64_t get_best_effort_duration(ConcatFile *file, AVFormatContext *avf) if (file->user_duration != AV_NOPTS_VALUE) return file->user_duration; if (file->outpoint != AV_NOPTS_VALUE) - return file->outpoint - file->file_inpoint; + return av_sat_sub64(file->outpoint, file->file_inpoint); if (avf->duration > 0) return avf->duration - (file->file_inpoint - file->file_start_time); if (file->next_dts != AV_NOPTS_VALUE)