This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 0a8d961388 avformat/matroskadec: avoid signed overflow in DASH cue
time differences
0a8d961388 is described below
commit 0a8d9613887777b4aa60815e9d4fa7fb03a47948
Author: Michael Niedermayer <[email protected]>
AuthorDate: Sun May 31 03:47:27 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Sun Jun 7 02:56:44 2026 +0000
avformat/matroskadec: avoid signed overflow in DASH cue time differences
Fixes:
493466409/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6150181551931392
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/matroskadec.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 965674bc3b..90fdb6c8ae 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -4625,7 +4625,8 @@ static CueDesc get_cue_desc(AVFormatContext *s, int64_t
ts, int64_t cues_start)
cue_desc.end_offset = cues_start - matroska->segment_start;
}
- if (cue_desc.end_time_ns < cue_desc.start_time_ns)
+ if (cue_desc.end_time_ns < cue_desc.start_time_ns ||
+ cue_desc.end_time_ns - (uint64_t)cue_desc.start_time_ns > INT64_MAX)
return (CueDesc) {-1, -1, -1, -1};
return cue_desc;
@@ -4819,11 +4820,14 @@ static int64_t
webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t
bits_per_second = 0.0;
do {
int64_t desc_bytes = desc_end.end_offset -
desc_beg.start_offset;
- int64_t desc_ns = desc_end.end_time_ns -
desc_beg.start_time_ns;
double desc_sec, calc_bits_per_second, percent,
mod_bits_per_second;
if (desc_bytes <= 0 || desc_bytes > INT64_MAX/8)
return -1;
+ if (desc_end.end_time_ns <= desc_beg.start_time_ns ||
+ desc_end.end_time_ns - (uint64_t)desc_beg.start_time_ns >
INT64_MAX)
+ return -1;
+ int64_t desc_ns = desc_end.end_time_ns -
desc_beg.start_time_ns;
desc_sec = desc_ns / nano_seconds_per_second;
calc_bits_per_second = (desc_bytes * 8) / desc_sec;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
