Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6566001610719232
Unified · Split
| @@ -245,6 +245,11 @@ static int decode_main_header(NUTContext *nut) · 244 unmodified lines | ||
| 245 | 245 | for (i = 0; i < 256;) { |
| 246 | 246 | int tmp_flags = ffio_read_varlen(bc); |
| 247 | 247 | int tmp_fields = ffio_read_varlen(bc); |
| 248 | + if (tmp_fields < 0) { | |
| 249 | + av_log(s, AV_LOG_ERROR, "fields %d is invalid\n", tmp_fields); | |
| 250 | + ret = AVERROR_INVALIDDATA; | |
| 251 | + goto fail; | |
| 252 | + } | |
| 248 | 253 | |
| 249 | 254 | if (tmp_fields > 0) |
| 250 | 255 | tmp_pts = get_s(bc); |