diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-09-18 16:29:37 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-09-24 18:28:29 +0200 |
| commit | 981f5e46afa3673dfa43eb2bf5017680d5df25dd (patch) | |
| tree | 42fa564e1b3e850e262ee4ca9aa2f0d5075b6dd7 | |
| parent | 2cb7ee8a36bddd3425897135db514ca62fec6e44 (diff) | |
avformat/sbgdec: clamp end_ts
Fixes: signed integer overflow: 9223372036851135042 + 15666854 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6573717339111424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/sbgdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c index 8a6d679056..4cd12347e7 100644 --- a/libavformat/sbgdec.c +++ b/libavformat/sbgdec.c @@ -1478,7 +1478,7 @@ static int sbg_read_packet(AVFormatContext *avf, AVPacket *packet) int ret; ts = ffstream(avf->streams[0])->cur_dts; - end_ts = ts + avf->streams[0]->codecpar->frame_size; + end_ts = av_sat_add64(ts, avf->streams[0]->codecpar->frame_size); if (avf->streams[0]->duration != AV_NOPTS_VALUE) end_ts = FFMIN(avf->streams[0]->start_time + avf->streams[0]->duration, end_ts); |