PR #25732 opened by DeVshaurya01 URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25732 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25732.patch
Fixes: signed integer overflow: -9223372036854775808 * 2368 cannot be represented in type int64_t Signed-off-by: Shaurya Atram <[email protected]> # Summary of changes Briefly describe what this PR does and why. <!-- If this PR requires new FATE test samples, attach them to the PR and list their target paths below (relative to the fate-suite root). Attached filenames must match the sample's filename: ```fate-samples # e.g. vorbis/new-sample.ogg ``` --> >From abdfddabaeb1080641e86b6839cd0bce487a6163 Mon Sep 17 00:00:00 2001 From: Shaurya Atram <[email protected]> Date: Tue, 3 Nov 2026 15:16:40 +0000 Subject: [PATCH] avformat/tmv: check timestamp in tmv_read_seek Fixes: signed integer overflow: -9223372036854775808 * 2368 cannot be represented in type int64_t Signed-off-by: Shaurya Atram <[email protected]> --- libavformat/tmv.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libavformat/tmv.c b/libavformat/tmv.c index ae4973f0f37..3e43118defb 100644 --- a/libavformat/tmv.c +++ b/libavformat/tmv.c @@ -172,17 +172,22 @@ static int tmv_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags) { TMVContext *tmv = s->priv_data; + int64_t chunk_size = tmv->audio_chunk_size + tmv->video_chunk_size + tmv->padding; int64_t pos; if (stream_index) return -1; - pos = timestamp * - (tmv->audio_chunk_size + tmv->video_chunk_size + tmv->padding); + if (timestamp < 0 || + (chunk_size && timestamp > (INT64_MAX - TMV_HEADER_SIZE) / chunk_size)) + return -1; + + pos = timestamp * chunk_size; if (avio_seek(s->pb, pos + TMV_HEADER_SIZE, SEEK_SET) < 0) return -1; tmv->stream_index = 0; + avpriv_update_cur_dts(s, s->streams[0], timestamp); return 0; } -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
