This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 0465a9bb8f46ebcd168d7edc221bc52aa620272c Author: Michael Niedermayer <[email protected]> AuthorDate: Sat Feb 21 01:21:18 2026 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Mon Mar 2 19:04:26 2026 +0100 avformat/demux: Fix integer overflows in select_from_pts_buffer() Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long long'); cast to an unsigned type to negate this value to itself Fixes: 473334102/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5109540931829760 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/demux.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/libavformat/demux.c b/libavformat/demux.c index 3cc48fd49e..b794364b4f 100644 --- a/libavformat/demux.c +++ b/libavformat/demux.c @@ -812,9 +812,14 @@ static int64_t select_from_pts_buffer(AVStream *st, int64_t *pts_buffer, int64_t } else { for (int i = 0; i < delay; i++) { if (pts_buffer[i] != AV_NOPTS_VALUE) { - int64_t diff = FFABS(pts_buffer[i] - dts) - + (uint64_t)sti->pts_reorder_error[i]; - diff = FFMAX(diff, sti->pts_reorder_error[i]); +#define ABSDIFF(a,b) (((a) < (b)) ? (b) - (uint64_t)(a) : ((a) - (uint64_t)(b))) + uint64_t diff = ABSDIFF(pts_buffer[i], dts); + + if (diff > INT64_MAX - sti->pts_reorder_error[i]) { + diff = INT64_MAX; + } else + diff += sti->pts_reorder_error[i]; + sti->pts_reorder_error[i] = diff; sti->pts_reorder_error_count[i]++; if (sti->pts_reorder_error_count[i] > 250) { _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
