This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg.
commit 178a340820f6b8b70e555c6862d9c951eb37782e Author: Michael Niedermayer <[email protected]> AuthorDate: Sun May 31 03:47:27 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 04:59:11 2026 +0200 avformat/matroskadec: avoid signed overflow in DASH cue time differences Fixes: 493466409/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6150181551931392 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 0a8d9613887777b4aa60815e9d4fa7fb03a47948) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/matroskadec.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index d62daa8d1f..9a830091ec 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -4456,7 +4456,8 @@ static CueDesc get_cue_desc(AVFormatContext *s, int64_t ts, int64_t cues_start) cue_desc.end_offset = cues_start - matroska->segment_start; } - if (cue_desc.end_time_ns < cue_desc.start_time_ns) + if (cue_desc.end_time_ns < cue_desc.start_time_ns || + cue_desc.end_time_ns - (uint64_t)cue_desc.start_time_ns > INT64_MAX) return (CueDesc) {-1, -1, -1, -1}; return cue_desc; @@ -4650,11 +4651,14 @@ static int64_t webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t bits_per_second = 0.0; do { int64_t desc_bytes = desc_end.end_offset - desc_beg.start_offset; - int64_t desc_ns = desc_end.end_time_ns - desc_beg.start_time_ns; double desc_sec, calc_bits_per_second, percent, mod_bits_per_second; if (desc_bytes <= 0 || desc_bytes > INT64_MAX/8) return -1; + if (desc_end.end_time_ns <= desc_beg.start_time_ns || + desc_end.end_time_ns - (uint64_t)desc_beg.start_time_ns > INT64_MAX) + return -1; + int64_t desc_ns = desc_end.end_time_ns - desc_beg.start_time_ns; desc_sec = desc_ns / nano_seconds_per_second; calc_bits_per_second = (desc_bytes * 8) / desc_sec; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
