[PATCH] avformat/subfile: clip seek offset
Fixes: signed integer overflow: 9223372036854737920 + 1649410 cannot be represented in type 'int64_t' Fixes OSS-Fuzz: 410100610 Signed-off-by: Kacper Michajłow <kasper93@gmail.com> --- libavformat/subfile.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavformat/subfile.c b/libavformat/subfile.c index be48ef72ef..b8c6ce0eef 100644 --- a/libavformat/subfile.c +++ b/libavformat/subfile.c @@ -128,13 +128,13 @@ static int64_t subfile_seek(URLContext *h, int64_t pos, int whence) case AVSEEK_SIZE: return end - c->start; case SEEK_SET: - new_pos = c->start + pos; + new_pos = c->start + av_clip(pos, 0, end - c->start); break; case SEEK_CUR: - new_pos = c->pos + pos; + new_pos = c->pos + av_clip(pos, -(c->pos - c->start), end - c->pos); break; case SEEK_END: - new_pos = end + pos; + new_pos = end + av_clip(pos, -(end - c->start), 0); break; default: av_assert0(0); -- 2.47.2
On Fri, 11 Jul 2025 at 21:49, Kacper Michajłow <kasper93@gmail.com> wrote:
Fixes: signed integer overflow: 9223372036854737920 + 1649410 cannot be represented in type 'int64_t'
Fixes OSS-Fuzz: 410100610
Signed-off-by: Kacper Michajłow <kasper93@gmail.com> --- libavformat/subfile.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavformat/subfile.c b/libavformat/subfile.c index be48ef72ef..b8c6ce0eef 100644 --- a/libavformat/subfile.c +++ b/libavformat/subfile.c @@ -128,13 +128,13 @@ static int64_t subfile_seek(URLContext *h, int64_t pos, int whence) case AVSEEK_SIZE: return end - c->start; case SEEK_SET: - new_pos = c->start + pos; + new_pos = c->start + av_clip(pos, 0, end - c->start); break; case SEEK_CUR: - new_pos = c->pos + pos; + new_pos = c->pos + av_clip(pos, -(c->pos - c->start), end - c->pos); break; case SEEK_END: - new_pos = end + pos; + new_pos = end + av_clip(pos, -(end - c->start), 0); break; default: av_assert0(0); -- 2.47.2
Will apply later if there is no objection. - Kacper
On Fri, Jul 11, 2025 at 09:49:29PM +0200, Kacper Michajłow wrote:
Fixes: signed integer overflow: 9223372036854737920 + 1649410 cannot be represented in type 'int64_t'
Fixes OSS-Fuzz: 410100610
Signed-off-by: Kacper Michajłow <kasper93@gmail.com> --- libavformat/subfile.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavformat/subfile.c b/libavformat/subfile.c index be48ef72ef..b8c6ce0eef 100644 --- a/libavformat/subfile.c +++ b/libavformat/subfile.c @@ -128,13 +128,13 @@ static int64_t subfile_seek(URLContext *h, int64_t pos, int whence) case AVSEEK_SIZE: return end - c->start; case SEEK_SET: - new_pos = c->start + pos; + new_pos = c->start + av_clip(pos, 0, end - c->start); break; case SEEK_CUR: - new_pos = c->pos + pos; + new_pos = c->pos + av_clip(pos, -(c->pos - c->start), end - c->pos); break; case SEEK_END: - new_pos = end + pos; + new_pos = end + av_clip(pos, -(end - c->start), 0); break; default: av_assert0(0);
regression fix for this is here: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20055 [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB During times of universal deceit, telling the truth becomes a revolutionary act. -- George Orwell
Michael Niedermayer (HE12025-07-29):
regression fix for this is here: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20055
I see no commit message. I see removing opening braces without removing them. (see attached screenshot; maybe it looks better for others) As is: rejected and revert the previous patch. Regards, -- Nicolas George
Hi Nicolas! Am 29. Juli 2025 10:55:15 MESZ schrieb Nicolas George <george@nsup.org>:
Michael Niedermayer (HE12025-07-29):
regression fix for this is here: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20055
I see no commit message.
I see removing opening braces without removing them.
(see attached screenshot; maybe it looks better for others)
You are looking at the overview with latest events for that PR. To see the the individual commits select that view at the top. Or if you want to see the combined diff, click on changes one further to the right. Best regards, Alexander
As is: rejected and revert the previous patch.
Regards,
Alexander Strasser via ffmpeg-devel (HE12025-07-29):
You are looking at the overview with latest events for that PR.
To see the the individual commits select that view at the top. Or if you want to see the combined diff, click on changes one further to the right.
This thing is looking more and more like a bad joke. How many clicks to achieve something that was done with a single key stroke? I will review the patch when I see it in diff format on the mailing-list. Regards, -- Nicolas George
On Tue, 29 Jul 2025 at 22:59, Nicolas George <george@nsup.org> wrote:
Alexander Strasser via ffmpeg-devel (HE12025-07-29):
You are looking at the overview with latest events for that PR.
To see the the individual commits select that view at the top. Or if you want to see the combined diff, click on changes one further to the right.
This thing is looking more and more like a bad joke. How many clicks to achieve something that was done with a single key stroke?
I will review the patch when I see it in diff format on the mailing-list.
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20055.patch - Kacper
Kacper Michajlow (HE12025-07-29):
You forgot to do a copy-paste. -- Nicolas George
Am 29. Juli 2025 22:59:22 MESZ schrieb Nicolas George <george@nsup.org>:
Alexander Strasser via ffmpeg-devel (HE12025-07-29):
You are looking at the overview with latest events for that PR.
To see the the individual commits select that view at the top. Or if you want to see the combined diff, click on changes one further to the right.
This thing is looking more and more like a bad joke. How many clicks to achieve something that was done with a single key stroke?
It's about having a place where things come together as proposed changes with testing, comments, and review. Also to make FFmpeg more attractive for new contributors and hopefully maintainers as well. Receiving and controlling everything via mails was never an objective AFAIK. And IMHO it should not be. There is CLI tooling which might or might not suit your preferences.
I will review the patch when I see it in diff format on the mailing-list.
One motivation was to remove the sending and multiple resending of patch sets from the mailing list. So it feels backwards to send the Patches back onto the list. As was rightly pointed out in other recent threads we need to find a good ways to keep all people needed or interested informed. Find a way to organize stuff now it is centralized. It is not so much different to using Trac for issue tracking (as we now do for along time), but this time just for code changes too. There is a lot to still figure out and that is expected and do-able. Just needs some more work and co-operation. Best regards, Alexander
Alexander Strasser via ffmpeg-devel (HE12025-07-30):
Also to make FFmpeg more attractive for new contributors and hopefully maintainers as well.
At some point, I hope you will realize how bad an idea it is to try to attract more newbies, dilettantes and vibe coders at the cost of making the people who have the knowledge to review patches less productive.
Receiving and controlling everything via mails was never an objective AFAIK. And IMHO it should not be.
There is CLI tooling which might or might not suit your preferences.
Then let us pull the plus on this half-assed experiment and maybe start again in a year or two when these are documented and up to their promises.
There is a lot to still figure out and that is expected and do-able. Just needs some more work and co-operation.
I clarify but stand by my position: I will review this patch when doing so does not require more work than it used to. Regards, -- Nicolas George
participants (5)
-
Alexander Strasser -
Kacper Michajlow -
Kacper Michajłow
-
Michael Niedermayer -
Nicolas George