Fixes: signed integer overflow: 2 * -4962931467012268000 cannot be represented in type 'long' Fixes: 376496313/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-4921469185884160
Unified · Split
| @@ -1928,6 +1928,8 @@ static int mxf_edit_unit_absolute_offset(MXFContext *mxf, MXFIndexTable *index_t · 1927 unmodified lines | ||
| 1928 | 1928 | // clamp to actual range of index |
| 1929 | 1929 | index_end = av_sat_add64(last_segment->index_start_position, last_segment->index_duration); |
| 1930 | 1930 | edit_unit = FFMAX(FFMIN(edit_unit, index_end), first_segment->index_start_position); |
| 1931 | + if (edit_unit < 0) | |
| 1932 | + return AVERROR_PATCHWELCOME; | |
| 1931 | 1933 | |
| 1932 | 1934 | // guess which table segment this edit unit is in |
| 1933 | 1935 | // saturation is fine since it's just a guess |