github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-04-20 21:00:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

avformat/demux: Fix integer overflows in select_from_pts_buffer()

Browse Source 
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long long'); cast to an unsigned type to negate this value to itself
Fixes: 473334102/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5109540931829760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-02-21 01:21:18 +01:00
parent 09ab2d18ed
commit 0465a9bb8f
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
libavformat/demux.c
View File

@@ -812,9 +812,14 @@ static int64_t select_from_pts_buffer(AVStream *st, int64_t *pts_buffer, int64_t
} else {
for (int i = 0; i < delay; i++) {
if (pts_buffer[i] != AV_NOPTS_VALUE) {
int64_t diff = FFABS(pts_buffer[i] - dts)
+ (uint64_t)sti->pts_reorder_error[i];
diff = FFMAX(diff, sti->pts_reorder_error[i]);
#define ABSDIFF(a,b) (((a) < (b)) ? (b) - (uint64_t)(a) : ((a) - (uint64_t)(b)))
uint64_t diff = ABSDIFF(pts_buffer[i], dts);
if (diff > INT64_MAX - sti->pts_reorder_error[i]) {
diff = INT64_MAX;
} else
diff += sti->pts_reorder_error[i];
sti->pts_reorder_error[i] = diff;
sti->pts_reorder_error_count[i]++;
if (sti->pts_reorder_error_count[i] > 250) {