Fixes: multiple integer overflows Fixes: 401016767/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6242067591790592
Unified · Split
| @@ -6295,6 +6295,11 @@ static int mov_read_elst(MOVContext *c, AVIOContext *pb, MOVAtom atom) · 6294 unmodified lines | ||
| 6295 | 6295 | c->fc->nb_streams-1, i, e->time); |
| 6296 | 6296 | return AVERROR_INVALIDDATA; |
| 6297 | 6297 | } |
| 6298 | + if (e->duration < 0) { | |
| 6299 | + av_log(c->fc, AV_LOG_ERROR, "Track %d, edit %d: Invalid edit list duration=%"PRId64"\n", | |
| 6300 | + c->fc->nb_streams-1, i, e->duration); | |
| 6301 | + return AVERROR_INVALIDDATA; | |
| 6302 | + } | |
| 6298 | 6303 | } |
| 6299 | 6304 | sc->elst_count = i; |
| 6300 | 6305 | |