From 0d088a47ca0243576078f109fff20617d1fac382 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 15 Oct 2020 22:04:56 +0200 Subject: avformat/asfdec_f: Check name_len for overflow Fixes: signed integer overflow: -1172299744 * 2 cannot be represented in type 'int' Fixes: 26258/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5672758488596480 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/asfdec_f.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'libavformat/asfdec_f.c') diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c index 103155e9e7..ff9107d73f 100644 --- a/libavformat/asfdec_f.c +++ b/libavformat/asfdec_f.c @@ -769,6 +769,8 @@ static int asf_read_marker(AVFormatContext *s, int64_t size) avio_rl32(pb); // send time avio_rl32(pb); // flags name_len = avio_rl32(pb); // name length + if ((unsigned)name_len > INT_MAX / 2) + return AVERROR_INVALIDDATA; if ((ret = avio_get_str16le(pb, name_len * 2, name, sizeof(name))) < name_len) avio_skip(pb, name_len - ret); -- cgit v1.2.3