[FFmpeg-cvslog] avformat/realtextdec: read_ts() in 64bits
Michael Niedermayer
git at videolan.org
Sun Dec 6 22:04:35 EET 2020
ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Thu Nov 5 16:19:18 2020 +0100| [47c146a56b5f6641dcf02bbaa056588d5536c582] | committer: Michael Niedermayer
avformat/realtextdec: read_ts() in 64bits
Fixes: signed integer overflow: 46671062 * 100 cannot be represented in type 'int'
Fixes: 26826/clusterfuzz-testcase-minimized-ffmpeg_dem_REALTEXT_fuzzer-5644062910316544
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=47c146a56b5f6641dcf02bbaa056588d5536c582
---
libavformat/realtextdec.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/libavformat/realtextdec.c b/libavformat/realtextdec.c
index c2316da0ed..390f8ddc67 100644
--- a/libavformat/realtextdec.c
+++ b/libavformat/realtextdec.c
@@ -45,16 +45,16 @@ static int realtext_probe(const AVProbeData *p)
return !av_strncasecmp(buf, "<window", 7) ? AVPROBE_SCORE_EXTENSION : 0;
}
-static int read_ts(const char *s)
+static int64_t read_ts(const char *s)
{
int hh, mm, ss, ms;
- if (sscanf(s, "%u:%u:%u.%u", &hh, &mm, &ss, &ms) == 4) return (hh*3600 + mm*60 + ss) * 100 + ms;
- if (sscanf(s, "%u:%u:%u" , &hh, &mm, &ss ) == 3) return (hh*3600 + mm*60 + ss) * 100;
- if (sscanf(s, "%u:%u.%u", &mm, &ss, &ms) == 3) return ( mm*60 + ss) * 100 + ms;
- if (sscanf(s, "%u:%u" , &mm, &ss ) == 2) return ( mm*60 + ss) * 100;
- if (sscanf(s, "%u.%u", &ss, &ms) == 2) return ( ss) * 100 + ms;
- return strtol(s, NULL, 10) * 100;
+ if (sscanf(s, "%u:%u:%u.%u", &hh, &mm, &ss, &ms) == 4) return (hh*3600LL + mm*60LL + ss) * 100LL + ms;
+ if (sscanf(s, "%u:%u:%u" , &hh, &mm, &ss ) == 3) return (hh*3600LL + mm*60LL + ss) * 100LL;
+ if (sscanf(s, "%u:%u.%u", &mm, &ss, &ms) == 3) return ( mm*60LL + ss) * 100LL + ms;
+ if (sscanf(s, "%u:%u" , &mm, &ss ) == 2) return ( mm*60LL + ss) * 100LL;
+ if (sscanf(s, "%u.%u", &ss, &ms) == 2) return ( ss) * 100LL + ms;
+ return strtol(s, NULL, 10) * 100LL;
}
static int realtext_read_header(AVFormatContext *s)
More information about the ffmpeg-cvslog
mailing list