[FFmpeg-cvslog] avformat/wavdec: satuarte next_tag_ofs, data_end

[Michael Niedermayer]

ffmpeg | branch: release/6.0 | Michael Niedermayer <michael at niedermayer.cc> | Tue Mar 26 00:50:36 2024 +0100| [05d253b4205b608d9f31ec7aabd401fad5f58879] | committer: Michael Niedermayer

avformat/wavdec: satuarte next_tag_ofs, data_end

Fixes: signed integer overflow: 5053074104798691550 + 5053074104259715104 cannot be represented in type 'long'
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-6515315309936640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 61dca9e150b723a160d4a570885f3e5326c3d276)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=05d253b4205b608d9f31ec7aabd401fad5f58879
---

 libavformat/wavdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index b145e98041..7b95dc4b5d 100644
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -444,7 +444,7 @@ static int wav_read_header(AVFormatContext *s)
             }
 
             if (rf64 || bw64) {
-                next_tag_ofs = wav->data_end = avio_tell(pb) + data_size;
+                next_tag_ofs = wav->data_end = av_sat_add64(avio_tell(pb), data_size);
             } else if (size != 0xFFFFFFFF) {
                 data_size    = size;
                 next_tag_ofs = wav->data_end = size ? next_tag_ofs : INT64_MAX;