PR #23293 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23293 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23293.patch
Fixes: 493466409/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6150181551931392 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From de78d9aedb6cf80a47e1166c1898bbbc5bf5687a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 31 May 2026 03:47:27 +0200 Subject: [PATCH] avformat/matroskadec: avoid signed overflow in DASH cue time differences Fixes: 493466409/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6150181551931392 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/matroskadec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index bc584abc75..d19753de73 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -4622,6 +4622,9 @@ static int buffer_size_after_time_downloaded(int64_t time_ns, double search_sec, while (desc_curr.start_time_ns != -1) { int64_t desc_bytes = desc_curr.end_offset - desc_curr.start_offset; + + if (desc_curr.end_time_ns - (uint64_t)desc_curr.start_time_ns > INT64_MAX) + return -1; int64_t desc_ns = desc_curr.end_time_ns - desc_curr.start_time_ns; double desc_sec = desc_ns / nano_seconds_per_second; double bits = (desc_bytes * 8.0); @@ -4714,11 +4717,14 @@ static int64_t webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t bits_per_second = 0.0; do { int64_t desc_bytes = desc_end.end_offset - desc_beg.start_offset; - int64_t desc_ns = desc_end.end_time_ns - desc_beg.start_time_ns; double desc_sec, calc_bits_per_second, percent, mod_bits_per_second; if (desc_bytes <= 0 || desc_bytes > INT64_MAX/8) return -1; + if (desc_end.end_time_ns <= desc_beg.start_time_ns || + desc_end.end_time_ns - (uint64_t)desc_beg.start_time_ns > INT64_MAX) + return -1; + int64_t desc_ns = desc_end.end_time_ns - desc_beg.start_time_ns; desc_sec = desc_ns / nano_seconds_per_second; calc_bits_per_second = (desc_bytes * 8) / desc_sec; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
