diff mbox series

[FFmpeg-devel,05/10] avformat/rpl: Use 64bit for total_audio_size and check it

Message ID 20240326001151.12083-5-michael@niedermayer.cc
State Accepted
Commit 878625812f164fbb733f442965235656d9eaccc8
Headers show
Series [FFmpeg-devel,01/10] avformat/concatdec: Check user_duration sum | expand

Checks

Context Check Description
andriy/configure_x86 warning Failed to apply patch
yinshiyou/configure_loongarch64 warning Failed to apply patch

Commit Message

Michael Niedermayer March 26, 2024, 12:11 a.m. UTC 
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4677434693517312
Fixes: signed integer overflow: 5555555555555555556 * 8 cannot be represented in type 'long long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/rpl.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/libavformat/rpl.c b/libavformat/rpl.c
index 3f10e51d482..09d0b68f748 100644
--- a/libavformat/rpl.c
+++ b/libavformat/rpl.c
@@ -118,7 +118,7 @@  static int rpl_read_header(AVFormatContext *s)
     AVIOContext *pb = s->pb;
     RPLContext *rpl = s->priv_data;
     AVStream *vst = NULL, *ast = NULL;
-    int total_audio_size;
+    int64_t total_audio_size;
     int error = 0;
     const char *endptr;
     char audio_type[RPL_LINE_LENGTH];
@@ -303,6 +303,8 @@  static int rpl_read_header(AVFormatContext *s)
         if (ast)
             av_add_index_entry(ast, offset + video_size, total_audio_size,
                                audio_size, audio_size * 8, 0);
+        if (total_audio_size/8 + (uint64_t)audio_size >= INT64_MAX/8)
+            return AVERROR_INVALIDDATA;
         total_audio_size += audio_size * 8;
     }