diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2023-09-30 21:33:34 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2023-10-08 21:36:05 +0200 |
| commit | 929ddef3f40102d6a84cfa17ed7c7ffebcf8236e (patch) | |
| tree | 1ad1e2e6c86d18417ebc00a592e95c469c4cf75c /libavformat | |
| parent | 5f0d00464a50994de0993e045e09313ca8d7cc8f (diff) | |
avformat/wavdec: Check left avio_tell for overflow
Fixes: signed integer overflow: 155 + 9223372036854775655 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5364032278495232
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/wavdec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index 2814466897..0c6629b157 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -767,6 +767,8 @@ smv_out: goto smv_retry; return AVERROR_EOF; } + if (INT64_MAX - left < avio_tell(s->pb)) + return AVERROR_INVALIDDATA; wav->data_end = avio_tell(s->pb) + left; } |