On Sun, Sep 20, 2020 at 10:26:05PM +0200, Michael Niedermayer wrote: > Fixes: signed integer overflow: 6000 * -2147483648 cannot be represented in > type 'int' > Fixes: > 25700/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6578316302352384 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <[email protected]> > --- > libavformat/wvdec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavformat/wvdec.c b/libavformat/wvdec.c > index b9fc6a59f9..b7d8dbbe78 100644 > --- a/libavformat/wvdec.c > +++ b/libavformat/wvdec.c > @@ -192,7 +192,7 @@ static int wv_read_block_header(AVFormatContext *ctx, > AVIOContext *pb) > if (id & 0x40) > avio_skip(pb, 1); > } > - if (rate == -1) { > + if (rate == -1 || rate * (uint64_t)rate_x >= INT_MAX) { > av_log(ctx, AV_LOG_ERROR,
AFAIK rate_x should be unsigned type from start. rate_x can be max (1U << 31) Otherwise patch is acceptable. > "Cannot determine custom sampling rate\n"); > return AVERROR_INVALIDDATA; > -- > 2.17.1 > > _______________________________________________ > ffmpeg-devel mailing list > [email protected] > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > [email protected] with subject "unsubscribe". _______________________________________________ ffmpeg-devel mailing list [email protected] https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email [email protected] with subject "unsubscribe".
