Fixes: signed integer overflow: -3483479120376300096 - 7442323944145700864 cannot be represented in type 'long' Fixes: 383187489/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4561470580391936
Unified · Split
| @@ -4618,9 +4618,10 @@ static int64_t webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t · 4617 unmodified lines | |||
| 4618 | // The prebuffer ends in the last Cue. Estimate how much data was | 4618 | // The prebuffer ends in the last Cue. Estimate how much data was |
| 4619 | // prebuffered. | 4619 | // prebuffered. |
| 4620 | pre_bytes = desc_end.end_offset - desc_end.start_offset; | 4620 | pre_bytes = desc_end.end_offset - desc_end.start_offset; |
| 4621 | pre_ns = desc_end.end_time_ns - desc_end.start_time_ns; | 4621 | if (desc_end.end_time_ns <= desc_end.start_time_ns || |
| 4622 | if (pre_ns <= 0) | 4622 | desc_end.end_time_ns - (uint64_t)desc_end.start_time_ns > INT64_MAX) |
| 4623 | return -1; | 4623 | return -1; |
| 4624 | pre_ns = desc_end.end_time_ns - desc_end.start_time_ns; | ||
| 4624 | pre_sec = pre_ns / nano_seconds_per_second; | 4625 | pre_sec = pre_ns / nano_seconds_per_second; |
| 4625 | prebuffer_bytes += | 4626 | prebuffer_bytes += |
| 4626 | pre_bytes * ((temp_prebuffer_ns / nano_seconds_per_second) / pre_sec); | 4627 | pre_bytes * ((temp_prebuffer_ns / nano_seconds_per_second) / pre_sec); |