The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/afe71350257c999a623d66d7f56e926552dc3737

commit afe71350257c999a623d66d7f56e926552dc3737
Author: Thomas Guilbert <tguilbert@chromium.org>
Date: Wed Apr 12 00:45:11 2017

Cherry-pick upstream USAN fixes

avformat/mov: Check creation_time for overflow

Fixes integer overflow

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39ee3ddff87a12e108fc4e0d36f756d0ca080472)

---

avformat/oggparsedaala: Do not leave an invalid value in gpshift

Fixes: undefined behavior

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 23ae3cc822915ede2bb4e85047ab46cc5bc71268)

---

avformat/oggparsedaala: Check duration for AV_NOPTS_VALUE

This avoids an integer overflow
the solution matches oggparsevorbis.c and
45581ed15d2ad5955e24d809820c1675da68f500

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 679a315424e6ffaafd21ebf7a86108bd4e743793)

Bug:  701640 ,  700242 ,  702974 
Change-Id: Ibcff00b7e137f2b07b062468ad42152dfd428a18
Reviewed-on: https://chromium-review.googlesource.com/475204
Reviewed-by: Matthew Wolenetz <wolenetz@chromium.org>

[modify] https://crrev.com/afe71350257c999a623d66d7f56e926552dc3737/libavformat/mov.c
[modify] https://crrev.com/afe71350257c999a623d66d7f56e926552dc3737/libavformat/oggparsedaala.c

ClusterFuzz has detected this issue as fixed in range 463875:463909.

Detailed report: https://clusterfuzz.com/testcase?key=4649784087674880

Fuzzer: libfuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  mov_metadata_creation_time
  mov_read_mvhd
  mov_read_default
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=433019:433116
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=463875:463909

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96UXz1gZ_1-0lLe5TsrE4XrXD4rxm-MTxYbyxj84kEJbj_wM9WV0iX81uZLZZhd8cLoVuhAoRxF3VBJXr8hN0sbWXCicCLzGkexbVbYS2SqJb5DiOIFErPNJLJZaJax5o7bcXC13Ui5soTBIwnGSWSdx5ABSHmUtG7OPM0sEHrFaVcejeOk6TLavyrquiddmnCP05oByhJCQaE01F5SX9keHRhDC-jlTtvHeXcTp9PZJzs19ktI1YMG2GMQ03onbCg3iy8OHoyMA-4pXdvd4EDKI-nSABXx8ai9CvXzlxv73V-ePsffTs_IMChVC8mXid6RAsmiwjhXUBbyIZr86UphuPZuQGjslLVG24nqiFNOcb4Dq3Y?testcase_id=4649784087674880


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4649784087674880 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.