diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-09-18 17:29:37 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-09-24 23:58:22 +0300 |
| commit | 3e2b970b00a469c9367a472c4f791c25e0e055eb (patch) | |
| tree | acb2089b7a54692be6ccc91e97dd66ca0e874e9c | |
| parent | 77628600aa589c3a03af30d015e9b07b866db00d (diff) | |
avformat/sbgdec: clamp end_ts
Fixes: signed integer overflow: 9223372036851135042 + 15666854 cannot be represented in type 'long'
Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6573717339111424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 981f5e46afa3673dfa43eb2bf5017680d5df25dd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/sbgdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c index 8a6d679056..4cd12347e7 100644 --- a/libavformat/sbgdec.c +++ b/libavformat/sbgdec.c @@ -1478,7 +1478,7 @@ static int sbg_read_packet(AVFormatContext *avf, AVPacket *packet) int ret; ts = ffstream(avf->streams[0])->cur_dts; - end_ts = ts + avf->streams[0]->codecpar->frame_size; + end_ts = av_sat_add64(ts, avf->streams[0]->codecpar->frame_size); if (avf->streams[0]->duration != AV_NOPTS_VALUE) end_ts = FFMIN(avf->streams[0]->start_time + avf->streams[0]->duration, end_ts); |