From 0a0b92b4b2b1288141059684cea741a79cc1e7f2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 4 Dec 2020 00:30:12 +0100 Subject: avformat/dhav: Check position for overflow Fixes: signed integer overflow: 9223372036854775807 + 32768 cannot be represented in type 'long' Fixes: 27744/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-5179319491756032 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/dhav.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libavformat') diff --git a/libavformat/dhav.c b/libavformat/dhav.c index 53deaff77e..00e0d8476e 100644 --- a/libavformat/dhav.c +++ b/libavformat/dhav.c @@ -173,12 +173,12 @@ static int read_chunk(AVFormatContext *s) if (avio_feof(s->pb)) return AVERROR_EOF; - if (avio_rl32(s->pb) != MKTAG('D','H','A','V')) { + if (avio_rl32(s->pb) != MKTAG('D','H','A','V') && dhav->last_good_pos < INT64_MAX - 0x8000) { dhav->last_good_pos += 0x8000; avio_seek(s->pb, dhav->last_good_pos, SEEK_SET); while (avio_rl32(s->pb) != MKTAG('D','H','A','V')) { - if (avio_feof(s->pb)) + if (avio_feof(s->pb) || dhav->last_good_pos >= INT64_MAX - 0x8000) return AVERROR_EOF; dhav->last_good_pos += 0x8000; ret = avio_skip(s->pb, 0x8000 - 4); -- cgit v1.2.3