avformat/dsicin: Check packet size for overflow
Fixes: signed integer overflow: 24672 + 2147483424 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_DSICIN_fuzzer-6731325979623424 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
5e38eff284
commit
9d1c47ec03
|
@ -166,7 +166,8 @@ static int cin_read_packet(AVFormatContext *s, AVPacket *pkt)
|
||||||
CinDemuxContext *cin = s->priv_data;
|
CinDemuxContext *cin = s->priv_data;
|
||||||
AVIOContext *pb = s->pb;
|
AVIOContext *pb = s->pb;
|
||||||
CinFrameHeader *hdr = &cin->frame_header;
|
CinFrameHeader *hdr = &cin->frame_header;
|
||||||
int rc, palette_type, pkt_size;
|
int rc, palette_type;
|
||||||
|
int64_t pkt_size;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
if (cin->audio_buffer_size == 0) {
|
if (cin->audio_buffer_size == 0) {
|
||||||
|
@ -182,7 +183,9 @@ static int cin_read_packet(AVFormatContext *s, AVPacket *pkt)
|
||||||
}
|
}
|
||||||
|
|
||||||
/* palette and video packet */
|
/* palette and video packet */
|
||||||
pkt_size = (palette_type + 3) * hdr->pal_colors_count + hdr->video_frame_size;
|
pkt_size = (palette_type + 3LL) * hdr->pal_colors_count + hdr->video_frame_size;
|
||||||
|
if (pkt_size + 4 > INT_MAX)
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
|
|
||||||
pkt_size = ffio_limit(pb, pkt_size);
|
pkt_size = ffio_limit(pb, pkt_size);
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue