[FFmpeg-cvslog] avformat/oggparseopus: Check that granule pos is within the supported range
Michael Niedermayer
git at videolan.org
Fri Aug 26 15:40:54 EEST 2016
ffmpeg | branch: release/2.8 | Michael Niedermayer <michael at niedermayer.cc> | Tue May 10 23:12:58 2016 +0200| [3bbef6082aee8effda8e3ed9c8083739e752b7e4] | committer: Michael Niedermayer
avformat/oggparseopus: Check that granule pos is within the supported range
Larger values would imply file durations of astronomic proportions and cause
overflows
Fixes integer overflow
Fixes: usan_int64_overflow
Found-by: Thomas Guilbert <tguilbert at google.com>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 8efaee3710baa87af40556a622bf2d96a27c6425)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3bbef6082aee8effda8e3ed9c8083739e752b7e4
---
libavformat/oggparseopus.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavformat/oggparseopus.c b/libavformat/oggparseopus.c
index c8b02fa..584fff4 100644
--- a/libavformat/oggparseopus.c
+++ b/libavformat/oggparseopus.c
@@ -117,6 +117,10 @@ static int opus_packet(AVFormatContext *avf, int idx)
if (!os->psize)
return AVERROR_INVALIDDATA;
+ if (os->granule > INT64_MAX - UINT32_MAX) {
+ av_log(avf, AV_LOG_ERROR, "Unsupported huge granule pos %"PRId64 "\n", os->granule);
+ return AVERROR_INVALIDDATA;
+ }
if ((!os->lastpts || os->lastpts == AV_NOPTS_VALUE) && !(os->flags & OGG_FLAG_EOS)) {
int seg, d;
More information about the ffmpeg-cvslog
mailing list