diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-12-04 00:30:12 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-01-08 18:08:57 +0100 |
| commit | 0a0b92b4b2b1288141059684cea741a79cc1e7f2 (patch) | |
| tree | 6cf19bc27de956dfdc5859848b0dcf04ed24f097 /libavformat | |
| parent | 380a3a0adfae7aa898d2ec8a5b0d5cd949a11111 (diff) | |
avformat/dhav: Check position for overflow
Fixes: signed integer overflow: 9223372036854775807 + 32768 cannot be represented in type 'long'
Fixes: 27744/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-5179319491756032
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/dhav.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/dhav.c b/libavformat/dhav.c index 53deaff77e..00e0d8476e 100644 --- a/libavformat/dhav.c +++ b/libavformat/dhav.c @@ -173,12 +173,12 @@ static int read_chunk(AVFormatContext *s) if (avio_feof(s->pb)) return AVERROR_EOF; - if (avio_rl32(s->pb) != MKTAG('D','H','A','V')) { + if (avio_rl32(s->pb) != MKTAG('D','H','A','V') && dhav->last_good_pos < INT64_MAX - 0x8000) { dhav->last_good_pos += 0x8000; avio_seek(s->pb, dhav->last_good_pos, SEEK_SET); while (avio_rl32(s->pb) != MKTAG('D','H','A','V')) { - if (avio_feof(s->pb)) + if (avio_feof(s->pb) || dhav->last_good_pos >= INT64_MAX - 0x8000) return AVERROR_EOF; dhav->last_good_pos += 0x8000; ret = avio_skip(s->pb, 0x8000 - 4); |