Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_NUT_fuzzer-6566001610719232
Unified · Split
| @@ -245,6 +245,11 @@ static int decode_main_header(NUTContext *nut) · 244 unmodified lines | |||
| 245 | for (i = 0; i < 256;) { | 245 | for (i = 0; i < 256;) { |
| 246 | int tmp_flags = ffio_read_varlen(bc); | 246 | int tmp_flags = ffio_read_varlen(bc); |
| 247 | int tmp_fields = ffio_read_varlen(bc); | 247 | int tmp_fields = ffio_read_varlen(bc); |
| 248 | if (tmp_fields < 0) { | ||
| 249 | av_log(s, AV_LOG_ERROR, "fields %d is invalid\n", tmp_fields); | ||
| 250 | ret = AVERROR_INVALIDDATA; | ||
| 251 | goto fail; | ||
| 252 | } | ||
| 248 | 253 | ||
| 249 | if (tmp_fields > 0) | 254 | if (tmp_fields > 0) |
| 250 | tmp_pts = get_s(bc); | 255 | tmp_pts = get_s(bc); |