[FFmpeg-cvslog] avformat/matroskadec: Check prebuffered_ns for overflow

[Michael Niedermayer]

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael at niedermayer.cc> | Sat Sep 30 23:44:25 2023 +0200| [2975984245ecad1b3b0930a32ce80340cf9a09e8] | committer: Michael Niedermayer

avformat/matroskadec: Check prebuffered_ns for overflow

Fixes: signed integer overflow: 9223372036630775808 + 1000000000 cannot be represented in type 'long'
Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-5406131992526848

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 2d6df3719dd4f75b40cdf25a02f3f075b76ed045)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2975984245ecad1b3b0930a32ce80340cf9a09e8
---

 libavformat/matroskadec.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index c47518b73a..d43b42ca39 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -4103,13 +4103,17 @@ static int64_t webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t
         int64_t prebuffer_ns = 1000000000;
         int64_t time_ns = st->index_entries[i].timestamp * matroska->time_scale;
         double nano_seconds_per_second = 1000000000.0;
-        int64_t prebuffered_ns = time_ns + prebuffer_ns;
+        int64_t prebuffered_ns;
         double prebuffer_bytes = 0.0;
         int64_t temp_prebuffer_ns = prebuffer_ns;
         int64_t pre_bytes, pre_ns;
         double pre_sec, prebuffer, bits_per_second;
         CueDesc desc_beg = get_cue_desc(s, time_ns, cues_start);
 
+        if (time_ns > INT64_MAX - prebuffer_ns)
+            return -1;
+        prebuffered_ns = time_ns + prebuffer_ns;
+
         // Start with the first Cue.
         CueDesc desc_end = desc_beg;