From 43b4c66e6b7dc788b8c6e4c9cfdb08bfa5ef2360 Mon Sep 17 00:00:00 2001 From: Andreas Rheinhardt Date: Fri, 11 Dec 2020 01:46:15 +0100 Subject: [PATCH] avformat/utils: Improve ffio_limit logic The earlier code would not complain if the remaining size was one byte short of the desired size; and the way it performed the check could run into signed integer overflow. Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long' Fixes: Timeout Fixes: 26434/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5752845451919360 Fixes: 26444/clusterfuzz-testcase-minimized-ffmpeg_dem_BINK_fuzzer-4697773380993024 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Michael Niedermayer Signed-off-by: Andreas Rheinhardt --- libavformat/utils.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavformat/utils.c b/libavformat/utils.c index 503e583ad0..1a87d9422a 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -253,9 +253,11 @@ int ffio_limit(AVIOContext *s, int size) remaining= FFMAX(remaining, 0); } - if (s->maxsize>= 0 && remaining+1 < size) { - av_log(NULL, remaining ? AV_LOG_ERROR : AV_LOG_DEBUG, "Truncating packet of size %d to %"PRId64"\n", size, remaining+1); - size = remaining+1; + if (s->maxsize >= 0 && remaining < size && size > 1) { + av_log(NULL, remaining ? AV_LOG_ERROR : AV_LOG_DEBUG, + "Truncating packet of size %d to %"PRId64"\n", + size, remaining + !remaining); + size = remaining + !remaining; } } return size;