[FFmpeg-devel] [PATCH 4/8] avformat/mxfdec: Fix file position addition

[Michael Niedermayer]

On Thu, Feb 04, 2021 at 05:07:31PM -0300, James Almer wrote:
> On 2/4/2021 3:43 PM, Tomas Härdin wrote:
> > mån 2021-02-01 klockan 23:31 +0100 skrev Michael Niedermayer:
> > > Not sure this is the best solution, maybe a more general solution
> > > limiting the avio_tell() output to less than 63bit would be a better
> > > option
> > 
> > Probably, since this is likely to happen in more places

iam not sure how to handle this in a more general way.
Simply limiting avio_tell to something seems arbitrary 


> > 
> > > Fixes: signed integer overflow: 9223372036854775805 + 4 cannot be represented in type 'long'
> > > Fixes: 29927/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5579985228267520
> > > 
> > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > > ---
> > >   libavformat/mxfdec.c | 2 +-
> > >   1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
> > > index afff20402d..97a1b749fe 100644
> > > --- a/libavformat/mxfdec.c
> > > +++ b/libavformat/mxfdec.c
> > > @@ -2861,7 +2861,7 @@ static int mxf_read_local_tags(MXFContext *mxf, KLVPacket *klv, MXFMetadataReadF
> > >           return AVERROR(ENOMEM);
> > >       if (ctx_size)
> > >           mxf_metadataset_init(ctx, type);
> > > -    while (avio_tell(pb) + 4 < klv_end && !avio_feof(pb)) {
> > > +    while (avio_tell(pb) + (uint64_t)4 < klv_end && !avio_feof(pb)) {
> > 
> > Why not cast avio_tell() instead?
> 
> Or use 4ULL

ok

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Frequently ignored answer#1 FFmpeg bugs should be sent to our bugtracker. User
questions about the command line tools should be sent to the ffmpeg-user ML.
And questions about how to use libav* should be sent to the libav-user ML.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20210315/7804e1a2/attachment.sig>