diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-09-18 17:29:37 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-11-04 01:29:52 +0300 |
| commit | eff1e619a9846e07c926a5a170b3dea72ca7a684 (patch) | |
| tree | 46ec3e14d8585b3138d554b30b0bea0feea03bf4 | |
| parent | 626094b9d34edb2d83cb6ba17fcb10083e0be55c (diff) | |
avformat/sbgdec: clamp end_ts
Fixes: signed integer overflow: 9223372036851135042 + 15666854 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6573717339111424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 981f5e46afa3673dfa43eb2bf5017680d5df25dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/sbgdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c index baffbbd6fd..2019995b09 100644 --- a/libavformat/sbgdec.c +++ b/libavformat/sbgdec.c @@ -1479,7 +1479,7 @@ static int sbg_read_packet(AVFormatContext *avf, AVPacket *packet) int ret; ts = ffstream(avf->streams[0])->cur_dts; - end_ts = ts + avf->streams[0]->codecpar->frame_size; + end_ts = av_sat_add64(ts, avf->streams[0]->codecpar->frame_size); if (avf->streams[0]->duration != AV_NOPTS_VALUE) end_ts = FFMIN(avf->streams[0]->start_time + avf->streams[0]->duration, end_ts); |