diff mbox series

[FFmpeg-devel,08/10] avformat/wavdec: satuarte next_tag_ofs, data_end

Message ID 20240326001151.12083-8-michael@niedermayer.cc
State Accepted
Commit 61dca9e150b723a160d4a570885f3e5326c3d276
Headers show
Series [FFmpeg-devel,01/10] avformat/concatdec: Check user_duration sum | expand

Checks

Context Check Description
andriy/configure_x86 warning Failed to apply patch
yinshiyou/configure_loongarch64 warning Failed to apply patch

Commit Message

Michael Niedermayer March 26, 2024, 12:11 a.m. UTC
Fixes: signed integer overflow: 5053074104798691550 + 5053074104259715104 cannot be represented in type 'long'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6515315309936640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/wavdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index 89855670d9c..0fed1ee6398 100644
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -453,7 +453,7 @@  static int wav_read_header(AVFormatContext *s)
             }
 
             if (rf64 || bw64) {
-                next_tag_ofs = wav->data_end = avio_tell(pb) + data_size;
+                next_tag_ofs = wav->data_end = av_sat_add64(avio_tell(pb), data_size);
             } else if (size != 0xFFFFFFFF) {
                 data_size    = size;
                 next_tag_ofs = wav->data_end = size ? next_tag_ofs : INT64_MAX;