[FFmpeg-devel,03/11] avcodec/utils: Check sample_rate before opening decoder

Submitted by Michael Niedermayer on Sept. 27, 2019, 5:23 p.m.

Details

Message ID 20190927172350.2095-3-michael@niedermayer.cc
State New
Headers show

Commit Message

Michael Niedermayer Sept. 27, 2019, 5:23 p.m.
Fixes: signed integer overflow: 2 * -1306460384 cannot be represented in type 'int'
Fixes: 17685/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_fuzzer-5747390337777664
Fixes: 17688/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5739287210885120
Fixes: 17699/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5678394531905536

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/utils.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

James Almer Sept. 30, 2019, 2:39 p.m.
On 9/27/2019 2:23 PM, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 2 * -1306460384 cannot be represented in type 'int'
> Fixes: 17685/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_fuzzer-5747390337777664
> Fixes: 17688/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5739287210885120
> Fixes: 17699/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5678394531905536
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/utils.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/libavcodec/utils.c b/libavcodec/utils.c
> index a19e0086cb..abb2c76924 100644
> --- a/libavcodec/utils.c
> +++ b/libavcodec/utils.c
> @@ -970,6 +970,10 @@ FF_ENABLE_DEPRECATION_WARNINGS
>              ret = AVERROR(EINVAL);
>              goto free_and_end;
>          }
> +        if (avctx->sample_rate < 0) {
> +            ret = AVERROR(EINVAL);
> +            goto free_and_end;
> +        }
>          if (avctx->bits_per_coded_sample < 0) {
>              ret = AVERROR(EINVAL);
>              goto free_and_end;

Should be ok.

Patch hide | download patch | download mbox

diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index a19e0086cb..abb2c76924 100644
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -970,6 +970,10 @@  FF_ENABLE_DEPRECATION_WARNINGS
             ret = AVERROR(EINVAL);
             goto free_and_end;
         }
+        if (avctx->sample_rate < 0) {
+            ret = AVERROR(EINVAL);
+            goto free_and_end;
+        }
         if (avctx->bits_per_coded_sample < 0) {
             ret = AVERROR(EINVAL);
             goto free_and_end;