[FFmpeg-devel] [PATCH] avformat/subfile: clip seek offset

[FFmpeg-devel] [PATCH] avformat/subfile: clip seek offset

[Kacper Michajłow]

Fixes: signed integer overflow: 9223372036854737920 + 1649410 cannot be
represented in type 'int64_t'

Fixes OSS-Fuzz: 410100610

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
---
 libavformat/subfile.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavformat/subfile.c b/libavformat/subfile.c
index be48ef72ef..b8c6ce0eef 100644
--- a/libavformat/subfile.c
+++ b/libavformat/subfile.c
@@ -128,13 +128,13 @@ static int64_t subfile_seek(URLContext *h, int64_t pos, int whence)
     case AVSEEK_SIZE:
         return end - c->start;
     case SEEK_SET:
-        new_pos = c->start + pos;
+        new_pos = c->start + av_clip(pos, 0, end - c->start);
         break;
     case SEEK_CUR:
-        new_pos = c->pos + pos;
+        new_pos = c->pos + av_clip(pos, -(c->pos - c->start), end - c->pos);
         break;
     case SEEK_END:
-        new_pos = end + pos;
+        new_pos = end + av_clip(pos, -(end - c->start), 0);
         break;
     default:
         av_assert0(0);
-- 
2.47.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avformat/subfile: clip seek offset

[Kacper Michajlow]

On Fri, 11 Jul 2025 at 21:49, Kacper Michajłow <kasper93@gmail.com> wrote:

> Fixes: signed integer overflow: 9223372036854737920 + 1649410 cannot be
> represented in type 'int64_t'
>
> Fixes OSS-Fuzz: 410100610
>
> Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
> ---
>  libavformat/subfile.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/libavformat/subfile.c b/libavformat/subfile.c
> index be48ef72ef..b8c6ce0eef 100644
> --- a/libavformat/subfile.c
> +++ b/libavformat/subfile.c
> @@ -128,13 +128,13 @@ static int64_t subfile_seek(URLContext *h, int64_t
> pos, int whence)
>      case AVSEEK_SIZE:
>          return end - c->start;
>      case SEEK_SET:
> -        new_pos = c->start + pos;
> +        new_pos = c->start + av_clip(pos, 0, end - c->start);
>          break;
>      case SEEK_CUR:
> -        new_pos = c->pos + pos;
> +        new_pos = c->pos + av_clip(pos, -(c->pos - c->start), end -
> c->pos);
>          break;
>      case SEEK_END:
> -        new_pos = end + pos;
> +        new_pos = end + av_clip(pos, -(end - c->start), 0);
>          break;
>      default:
>          av_assert0(0);
> --
> 2.47.2
>
>
Will apply later if there is no objection.

- Kacper
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avformat/subfile: clip seek offset

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 1453 bytes --]

On Fri, Jul 11, 2025 at 09:49:29PM +0200, Kacper Michajłow wrote:
> Fixes: signed integer overflow: 9223372036854737920 + 1649410 cannot be
> represented in type 'int64_t'
> 
> Fixes OSS-Fuzz: 410100610
> 
> Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
> ---
>  libavformat/subfile.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/libavformat/subfile.c b/libavformat/subfile.c
> index be48ef72ef..b8c6ce0eef 100644
> --- a/libavformat/subfile.c
> +++ b/libavformat/subfile.c
> @@ -128,13 +128,13 @@ static int64_t subfile_seek(URLContext *h, int64_t pos, int whence)
>      case AVSEEK_SIZE:
>          return end - c->start;
>      case SEEK_SET:
> -        new_pos = c->start + pos;
> +        new_pos = c->start + av_clip(pos, 0, end - c->start);
>          break;
>      case SEEK_CUR:
> -        new_pos = c->pos + pos;
> +        new_pos = c->pos + av_clip(pos, -(c->pos - c->start), end - c->pos);
>          break;
>      case SEEK_END:
> -        new_pos = end + pos;
> +        new_pos = end + av_clip(pos, -(end - c->start), 0);
>          break;
>      default:
>          av_assert0(0);

regression fix for this is here:
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20055

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

During times of universal deceit, telling the truth becomes a
revolutionary act. -- George Orwell

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avformat/subfile: clip seek offset

[Nicolas George]

[-- Attachment #1: Type: text/plain, Size: 345 bytes --]

Michael Niedermayer (HE12025-07-29):
> regression fix for this is here:
> https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20055

I see no commit message.

I see removing opening braces without removing them.

(see attached screenshot; maybe it looks better for others)

As is: rejected and revert the previous patch.

Regards,

-- 
  Nicolas George

[-- Attachment #2: patch.png --]
[-- Type: image/png, Size: 69317 bytes --]

[-- Attachment #3: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".