Fixes: signed integer overflow: -9223372036854775808 - 2082844800 cannot be represented in type 'long' Fixes: 58384/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6428383700713472
Showing the changes to libavformat (1 of 1 file). Show all
Unified · Split
| @@ -1521,6 +1521,10 @@ static void mov_metadata_creation_time(MOVContext *c, AVIOContext *pb, AVDiction · 1520 unmodified lines | |||
| 1521 | if (version == 1) { | 1521 | if (version == 1) { |
| 1522 | time = avio_rb64(pb); | 1522 | time = avio_rb64(pb); |
| 1523 | avio_rb64(pb); | 1523 | avio_rb64(pb); |
| 1524 | if (time < 0) { | ||
| 1525 | av_log(c->fc, AV_LOG_DEBUG, "creation_time is negative\n"); | ||
| 1526 | return; | ||
| 1527 | } | ||
| 1524 | } else { | 1528 | } else { |
| 1525 | time = avio_rb32(pb); | 1529 | time = avio_rb32(pb); |
| 1526 | avio_rb32(pb); /* modification time */ | 1530 | avio_rb32(pb); /* modification time */ |