[FFmpeg-cvslog] avformat/dsicin: Check packet size for overflow
Michael Niedermayer
git at videolan.org
Sat Jul 31 23:56:11 EEST 2021
ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Fri Apr 23 19:44:08 2021 +0200| [9d1c47ec033d038e04578eaf0767c8983250d03d] | committer: Michael Niedermayer
avformat/dsicin: Check packet size for overflow
Fixes: signed integer overflow: 24672 + 2147483424 cannot be represented in type 'int'
Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSICIN_fuzzer-6731325979623424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9d1c47ec033d038e04578eaf0767c8983250d03d
---
libavformat/dsicin.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/libavformat/dsicin.c b/libavformat/dsicin.c
index 5693b11e8c..481f365a53 100644
--- a/libavformat/dsicin.c
+++ b/libavformat/dsicin.c
@@ -166,7 +166,8 @@ static int cin_read_packet(AVFormatContext *s, AVPacket *pkt)
CinDemuxContext *cin = s->priv_data;
AVIOContext *pb = s->pb;
CinFrameHeader *hdr = &cin->frame_header;
- int rc, palette_type, pkt_size;
+ int rc, palette_type;
+ int64_t pkt_size;
int ret;
if (cin->audio_buffer_size == 0) {
@@ -182,7 +183,9 @@ static int cin_read_packet(AVFormatContext *s, AVPacket *pkt)
}
/* palette and video packet */
- pkt_size = (palette_type + 3) * hdr->pal_colors_count + hdr->video_frame_size;
+ pkt_size = (palette_type + 3LL) * hdr->pal_colors_count + hdr->video_frame_size;
+ if (pkt_size + 4 > INT_MAX)
+ return AVERROR_INVALIDDATA;
pkt_size = ffio_limit(pb, pkt_size);
More information about the ffmpeg-cvslog
mailing list