PR #22241 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22241 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22241.patch
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long long'); cast to an unsigned type to negate this value to itself Fixes: 473334102/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5109540931829760 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From f8ce7bd5081679bf74d3a3add0c3ed55cf52c4b2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 21 Feb 2026 01:21:18 +0100 Subject: [PATCH] avformat/demux: Fix integer overflows in select_from_pts_buffer() Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long long'); cast to an unsigned type to negate this value to itself Fixes: 473334102/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5109540931829760 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/demux.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/libavformat/demux.c b/libavformat/demux.c index 3cc48fd49e..b794364b4f 100644 --- a/libavformat/demux.c +++ b/libavformat/demux.c @@ -812,9 +812,14 @@ static int64_t select_from_pts_buffer(AVStream *st, int64_t *pts_buffer, int64_t } else { for (int i = 0; i < delay; i++) { if (pts_buffer[i] != AV_NOPTS_VALUE) { - int64_t diff = FFABS(pts_buffer[i] - dts) - + (uint64_t)sti->pts_reorder_error[i]; - diff = FFMAX(diff, sti->pts_reorder_error[i]); +#define ABSDIFF(a,b) (((a) < (b)) ? (b) - (uint64_t)(a) : ((a) - (uint64_t)(b))) + uint64_t diff = ABSDIFF(pts_buffer[i], dts); + + if (diff > INT64_MAX - sti->pts_reorder_error[i]) { + diff = INT64_MAX; + } else + diff += sti->pts_reorder_error[i]; + sti->pts_reorder_error[i] = diff; sti->pts_reorder_error_count[i]++; if (sti->pts_reorder_error_count[i] > 250) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
