avoids overflows with it Fixes: signed integer overflow: 9223372036846866010 + 4294967047 cannot be represented in type 'long' Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6538296768987136 Fixes: 50993/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-657169555665715
Unified · Split
| @@ -1242,6 +1242,8 @@ static int asf_read_packet_header(AVFormatContext *s) · 1241 unmodified lines | |||
| 1242 | unsigned char error_flags, len_flags, pay_flags; | 1242 | unsigned char error_flags, len_flags, pay_flags; |
| 1243 | 1243 | ||
| 1244 | asf->packet_offset = avio_tell(pb); | 1244 | asf->packet_offset = avio_tell(pb); |
| 1245 | if (asf->packet_offset > INT64_MAX/2) | ||
| 1246 | asf->packet_offset = 0; | ||
| 1245 | error_flags = avio_r8(pb); // read Error Correction Flags | 1247 | error_flags = avio_r8(pb); // read Error Correction Flags |
| 1246 | if (error_flags & ASF_PACKET_FLAG_ERROR_CORRECTION_PRESENT) { | 1248 | if (error_flags & ASF_PACKET_FLAG_ERROR_CORRECTION_PRESENT) { |
| 1247 | if (!(error_flags & ASF_ERROR_CORRECTION_LENGTH_TYPE)) { | 1249 | if (!(error_flags & ASF_ERROR_CORRECTION_LENGTH_TYPE)) { |