[oss-fuzz 5417860566679552] Integer-overflow in tt_timings_MergeParallel
Ref:
- https://oss-fuzz.com/testcase-detail/5417860566679552
- https://oss-fuzz.com/testcase-detail/5992306199298048
xeon ~/work/git/vlc/build-ubsan $ UBSAN_OPTIONS=exitcode=77:print_stacktrace=1:silence_unsigned_overflow=1 ./test/vlc-demux-dec-run /home/tom/Downloads/cluster*
../../modules/codec/ttml/ttml.h:203:13: runtime error: signed integer overflow: 27000000 - -9223372036854775808 cannot be represented in type 'long int'
#0 0x7f8f4180acbc in tt_time_Sub ../../modules/codec/ttml/ttml.h:203
#1 0x7f8f4180c68d in tt_timings_MergeParallel ../../modules/codec/ttml/ttml.c:640
#2 0x7f8f4180faf8 in tt_timings_Resolve ../../modules/codec/ttml/ttml.c:689
#3 0x7f8f4180fbc2 in tt_timings_Resolve ../../modules/codec/ttml/ttml.c:700
#4 0x7f8f4180fbc2 in tt_timings_Resolve ../../modules/codec/ttml/ttml.c:700
#5 0x7f8f4180fbc2 in tt_timings_Resolve ../../modules/codec/ttml/ttml.c:700
#6 0x7f8f4180a825 in tt_OpenDemux ../../modules/demux/ttml.c:366
#7 0x7f8f458234ae in demux_Probe ../../src/input/demux.c:112
#8 0x7f8f457c8db0 in vlc_module_load ../../src/modules/modules.c:230
#9 0x7f8f458241f4 in demux_NewAdvanced ../../src/input/demux.c:196
#10 0x7f8f4582463d in demux_New ../../src/input/demux.c:77
#11 0x563ca99a1352 in demux_process_stream ../../test/src/input/demux-run.c:300
#12 0x563ca99a1568 in vlc_demux_process_url ../../test/src/input/demux-run.c:354
#13 0x563ca99a160b in vlc_demux_process_path ../../test/src/input/demux-run.c:368
#14 0x563ca99a0463 in main ../../test/vlc-demux-run.c:50
#15 0x7f8f44c33d67 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#16 0x7f8f44c33e24 in __libc_start_main_impl ../csu/libc-start.c:360
#17 0x563ca99a02f0 in _start (/home/tom/work/git/vlc/build-ubsan/test/vlc-demux-dec-run+0x32f0) (BuildId: bd4b0846f7232edd09a0b1d9d03fe74e7faf36c6)
Sample: clusterfuzz-testcase-minimized-vlc-demux-dec-libfuzzer-ttml-5417860566679552
Edited by Thomas Guillem