[FFmpeg-devel] [PATCH 4/4] avcodec/dirac_parser: Fix overflow in dts

[James Almer]

On 7/11/2019 6:49 PM, Michael Niedermayer wrote:
> Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
> Fixes: 15568/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5634719611355136
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/dirac_parser.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/dirac_parser.c b/libavcodec/dirac_parser.c
> index 1ade44a438..8722ef17b7 100644
> --- a/libavcodec/dirac_parser.c
> +++ b/libavcodec/dirac_parser.c
> @@ -214,7 +214,7 @@ static int dirac_combine_frame(AVCodecParserContext *s, AVCodecContext *avctx,
>                                pc->index - 13 - pu1.prev_pu_offset;
>              int pts = AV_RB32(cur_pu + 13);
>              if (s->last_pts == 0 && s->last_dts == 0)
> -                s->dts = pts - 1;
> +                s->dts = pts - 1LL;

Unless that AV_RB32() value can be negative in valid bitstreams, just
make pts int64_t instead. That's the type for both pts and dts in
AVCodecParserContext.

>              else
>                  s->dts = s->last_dts + 1;
>              s->pts = pts;
>