[FFmpeg-devel] [PATCH] avformat/utils: check for integer overflow in av_get_frame_filename2()

[Michael Niedermayer]

On Sun, Aug 16, 2020 at 05:38:29PM +0200, Paul B Mahol wrote:
> On 8/16/20, Michael Niedermayer <michael at niedermayer.cc> wrote:
> > Fixes: signed integer overflow: 317316873 * 10 cannot be represented in type
> > 'int'
> > Fixes:
> > 24708/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5731180885049344
> >
> > Found-by: continuous fuzzing process
> > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavformat/utils.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/libavformat/utils.c b/libavformat/utils.c
> > index 807d9f10cb..60e6fe5be5 100644
> > --- a/libavformat/utils.c
> > +++ b/libavformat/utils.c
> > @@ -4745,8 +4745,11 @@ int av_get_frame_filename2(char *buf, int buf_size,
> > const char *path, int number
> >          if (c == '%') {
> >              do {
> >                  nd = 0;
> > -                while (av_isdigit(*p))
> > +                while (av_isdigit(*p)) {
> > +                    if (nd >= INT_MAX / 10 - 255)
> > +                        goto fail;
> >                      nd = nd * 10 + *p++ - '0';
> > +                }
> >                  c = *p++;
> >              } while (av_isdigit(c));
> >
> 
> Why to limit it?
> Use int64_t?

The buffer is only 20 bytes long, INT_MAX is already a few million times
more than what would work

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Concerning the gods, I have no means of knowing whether they exist or not
or of what sort they may be, because of the obscurity of the subject, and
the brevity of human life -- Protagoras
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20200816/131f509a/attachment.sig>