Fixes: signed integer overflow: 1073750247 * 2 cannot be represented in type 'int' Fixes: 70722/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5447231587549184
Unified · Split
| @@ -90,8 +90,8 @@ static int asf_read_picture(AVFormatContext *s, int len) · 89 unmodified lines | ||
| 90 | 90 | return 0; |
| 91 | 91 | } |
| 92 | 92 | |
| 93 | − if (picsize >= len) { | |
| 94 | − av_log(s, AV_LOG_ERROR, "Invalid attached picture data size: %d >= %d.\n", | |
| 93 | + if (picsize >= len || ((int64_t)len - picsize) * 2 + 1 > INT_MAX) { | |
| 94 | + av_log(s, AV_LOG_ERROR, "Invalid attached picture data size: %d (len = %d).\n", | |
| 95 | 95 | picsize, len); |
| 96 | 96 | return AVERROR_INVALIDDATA; |
| 97 | 97 | } |