Fixes: signed integer overflow: 9223372036854775807 + 564 cannot be represented in type 'long' Fixes: 26494/clusterfuzz-testcase-minimized-ffmpeg_dem_VOC_fuzzer-576754158849228 Fixes: 26549/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4844306424397824 FIxes: 26875/clusterfuzz-testcase-minimized-ffmpeg_dem_C93_fuzzer-5996226782429184
Unified · Split
| @@ -49,6 +49,8 @@ static int io_read(void *opaque, uint8_t *buf, int buf_size) · 48 unmodified lines | |||
| 49 | c->filesize = FFMIN(c->pos, c->filesize); | 49 | c->filesize = FFMIN(c->pos, c->filesize); |
| 50 | return AVERROR_EOF; | 50 | return AVERROR_EOF; |
| 51 | } | 51 | } |
| 52 | if (c->pos > INT64_MAX - size) | ||
| 53 | return AVERROR(EIO); | ||
| 52 | 54 | ||
| 53 | memcpy(buf, c->fuzz, size); | 55 | memcpy(buf, c->fuzz, size); |
| 54 | c->fuzz += size; | 56 | c->fuzz += size; |