Fixes: signed integer overflow: 1073750247 * 2 cannot be represented in type 'int' Fixes: 70722/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5447231587549184
Unified · Split
| @@ -90,8 +90,8 @@ static int asf_read_picture(AVFormatContext *s, int len) · 89 unmodified lines | |||
| 90 | return 0; | 90 | return 0; |
| 91 | } | 91 | } |
| 92 | 92 | ||
| 93 | if (picsize >= len) { | 93 | if (picsize >= len || ((int64_t)len - picsize) * 2 + 1 > INT_MAX) { |
| 94 | av_log(s, AV_LOG_ERROR, "Invalid attached picture data size: %d >= %d.\n", | 94 | av_log(s, AV_LOG_ERROR, "Invalid attached picture data size: %d (len = %d).\n", |
| 95 | picsize, len); | 95 | picsize, len); |
| 96 | return AVERROR_INVALIDDATA; | 96 | return AVERROR_INVALIDDATA; |
| 97 | } | 97 | } |