| Message ID | 20200920202608.11653-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avformat/wvdec: Check rate for overflow | expand |
| Context | Check | Description |
|---|---|---|
| andriy/default | pending | |
| andriy/make | success | Make finished |
| andriy/make_fate | success | Make fate finished |
On Sun, Sep 20, 2020 at 10:26:05PM +0200, Michael Niedermayer wrote: > Fixes: signed integer overflow: 6000 * -2147483648 cannot be represented in type 'int' > Fixes: 25700/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6578316302352384 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/wvdec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavformat/wvdec.c b/libavformat/wvdec.c > index b9fc6a59f9..b7d8dbbe78 100644 > --- a/libavformat/wvdec.c > +++ b/libavformat/wvdec.c > @@ -192,7 +192,7 @@ static int wv_read_block_header(AVFormatContext *ctx, AVIOContext *pb) > if (id & 0x40) > avio_skip(pb, 1); > } > - if (rate == -1) { > + if (rate == -1 || rate * (uint64_t)rate_x >= INT_MAX) { > av_log(ctx, AV_LOG_ERROR, AFAIK rate_x should be unsigned type from start. rate_x can be max (1U << 31) Otherwise patch is acceptable. > "Cannot determine custom sampling rate\n"); > return AVERROR_INVALIDDATA; > -- > 2.17.1 > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
On Mon, Sep 21, 2020 at 12:43:22AM +0200, Paul B Mahol wrote: > On Sun, Sep 20, 2020 at 10:26:05PM +0200, Michael Niedermayer wrote: > > Fixes: signed integer overflow: 6000 * -2147483648 cannot be represented in type 'int' > > Fixes: 25700/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6578316302352384 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/wvdec.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/libavformat/wvdec.c b/libavformat/wvdec.c > > index b9fc6a59f9..b7d8dbbe78 100644 > > --- a/libavformat/wvdec.c > > +++ b/libavformat/wvdec.c > > @@ -192,7 +192,7 @@ static int wv_read_block_header(AVFormatContext *ctx, AVIOContext *pb) > > if (id & 0x40) > > avio_skip(pb, 1); > > } > > - if (rate == -1) { > > + if (rate == -1 || rate * (uint64_t)rate_x >= INT_MAX) { > > av_log(ctx, AV_LOG_ERROR, > > AFAIK rate_x should be unsigned type from start. > rate_x can be max (1U << 31) > Otherwise patch is acceptable. will apply with rate_x type also changed to unsigned thx [...]
diff --git a/libavformat/wvdec.c b/libavformat/wvdec.c index b9fc6a59f9..b7d8dbbe78 100644 --- a/libavformat/wvdec.c +++ b/libavformat/wvdec.c @@ -192,7 +192,7 @@ static int wv_read_block_header(AVFormatContext *ctx, AVIOContext *pb) if (id & 0x40) avio_skip(pb, 1); } - if (rate == -1) { + if (rate == -1 || rate * (uint64_t)rate_x >= INT_MAX) { av_log(ctx, AV_LOG_ERROR, "Cannot determine custom sampling rate\n"); return AVERROR_INVALIDDATA;
Fixes: signed integer overflow: 6000 * -2147483648 cannot be represented in type 'int' Fixes: 25700/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6578316302352384 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/wvdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)