Commit c5cc3b08 authored by Michael Niedermayer's avatar Michael Niedermayer

avformat/oggdec: Fix integer overflow with invalid pts

If negative pts are possible for some codecs in ogg then the code needs to be
changed to use signed values.
Found-by: 's avatarThomas Guilbert <tguilbert@google.com>
Fixes: clusterfuzz_usan-2016-08-02
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 6cd9a8b6
...@@ -162,6 +162,11 @@ ogg_gptopts (AVFormatContext * s, int i, uint64_t gp, int64_t *dts) ...@@ -162,6 +162,11 @@ ogg_gptopts (AVFormatContext * s, int i, uint64_t gp, int64_t *dts)
if (dts) if (dts)
*dts = pts; *dts = pts;
} }
if (pts > INT64_MAX && pts != AV_NOPTS_VALUE) {
// The return type is unsigned, we thus cannot return negative pts
av_log(s, AV_LOG_ERROR, "invalid pts %"PRId64"\n", pts);
pts = AV_NOPTS_VALUE;
}
return pts; return pts;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment