diff mbox series

[FFmpeg-devel,1/4] avformat/wvdec: Check rate for overflow

Message ID 20200920202608.11653-1-michael@niedermayer.cc
State Accepted
Headers show
Series [FFmpeg-devel,1/4] avformat/wvdec: Check rate for overflow
Related show

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

Michael Niedermayer Sept. 20, 2020, 8:26 p.m. UTC
Fixes: signed integer overflow: 6000 * -2147483648 cannot be represented in type 'int'
Fixes: 25700/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6578316302352384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/wvdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Paul B Mahol Sept. 20, 2020, 10:43 p.m. UTC | #1
On Sun, Sep 20, 2020 at 10:26:05PM +0200, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 6000 * -2147483648 cannot be represented in type 'int'
> Fixes: 25700/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6578316302352384
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/wvdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/wvdec.c b/libavformat/wvdec.c
> index b9fc6a59f9..b7d8dbbe78 100644
> --- a/libavformat/wvdec.c
> +++ b/libavformat/wvdec.c
> @@ -192,7 +192,7 @@ static int wv_read_block_header(AVFormatContext *ctx, AVIOContext *pb)
>              if (id & 0x40)
>                  avio_skip(pb, 1);
>          }
> -        if (rate == -1) {
> +        if (rate == -1 || rate * (uint64_t)rate_x >= INT_MAX) {
>              av_log(ctx, AV_LOG_ERROR,

AFAIK rate_x should be unsigned type from start.
rate_x can be max (1U << 31)
Otherwise patch is acceptable.

>                     "Cannot determine custom sampling rate\n");
>              return AVERROR_INVALIDDATA;
> -- 
> 2.17.1
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
Michael Niedermayer Sept. 21, 2020, 9:55 a.m. UTC | #2
On Mon, Sep 21, 2020 at 12:43:22AM +0200, Paul B Mahol wrote:
> On Sun, Sep 20, 2020 at 10:26:05PM +0200, Michael Niedermayer wrote:
> > Fixes: signed integer overflow: 6000 * -2147483648 cannot be represented in type 'int'
> > Fixes: 25700/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6578316302352384
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavformat/wvdec.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavformat/wvdec.c b/libavformat/wvdec.c
> > index b9fc6a59f9..b7d8dbbe78 100644
> > --- a/libavformat/wvdec.c
> > +++ b/libavformat/wvdec.c
> > @@ -192,7 +192,7 @@ static int wv_read_block_header(AVFormatContext *ctx, AVIOContext *pb)
> >              if (id & 0x40)
> >                  avio_skip(pb, 1);
> >          }
> > -        if (rate == -1) {
> > +        if (rate == -1 || rate * (uint64_t)rate_x >= INT_MAX) {
> >              av_log(ctx, AV_LOG_ERROR,
> 
> AFAIK rate_x should be unsigned type from start.
> rate_x can be max (1U << 31)
> Otherwise patch is acceptable.

will apply with rate_x type also changed to unsigned

thx

[...]
diff mbox series

Patch

diff --git a/libavformat/wvdec.c b/libavformat/wvdec.c
index b9fc6a59f9..b7d8dbbe78 100644
--- a/libavformat/wvdec.c
+++ b/libavformat/wvdec.c
@@ -192,7 +192,7 @@  static int wv_read_block_header(AVFormatContext *ctx, AVIOContext *pb)
             if (id & 0x40)
                 avio_skip(pb, 1);
         }
-        if (rate == -1) {
+        if (rate == -1 || rate * (uint64_t)rate_x >= INT_MAX) {
             av_log(ctx, AV_LOG_ERROR,
                    "Cannot determine custom sampling rate\n");
             return AVERROR_INVALIDDATA;