| Message ID | 20230925112737.4039135-1-mezhuevtp@ispras.ru |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel] Numeric truncation in svs.c:57 | expand |
| Context | Check | Description |
|---|---|---|
| andriy/commit_msg_x86 | warning | The first line of the commit message must start with a context terminated by a colon and a space, for example "lavu/opt: " or "doc: ". |
| andriy/make_fate_x86 | success | Make fate finished |
| andriy/make_x86 | warning | New warnings during build |
mezhuevtp@ispras.ru: > From: headshog <craaaaaachind@gmail.com> > > Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`. > In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here. > Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`. > In a way not to break API/ABI, I've added a checker for valid `sample_rate` value. > --- > libavformat/svs.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/libavformat/svs.c b/libavformat/svs.c > index b91d29f5a6..54f24f539c 100644 > --- a/libavformat/svs.c > +++ b/libavformat/svs.c > @@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s) > { > AVStream *st; > uint32_t pitch; > + int64_t rescale_val; > + > + rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF); Using an uninitialized variable is supposed to fix something? > + if (rescale_val > INT_MAX) > + return AVERROR(ERANGE); > > st = avformat_new_stream(s, NULL); > if (!st) > @@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s) > st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; > st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX; > st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO; > - st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF); > + st->codecpar->sample_rate = rescale_val; > st->codecpar->block_align = 32; > st->start_time = 0; > if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
diff --git a/libavformat/svs.c b/libavformat/svs.c index b91d29f5a6..54f24f539c 100644 --- a/libavformat/svs.c +++ b/libavformat/svs.c @@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s) { AVStream *st; uint32_t pitch; + int64_t rescale_val; + + rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF); + if (rescale_val > INT_MAX) + return AVERROR(ERANGE); st = avformat_new_stream(s, NULL); if (!st) @@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s) st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX; st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO; - st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF); + st->codecpar->sample_rate = rescale_val; st->codecpar->block_align = 32; st->start_time = 0; if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
From: headshog <craaaaaachind@gmail.com> Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`. In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here. Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`. In a way not to break API/ABI, I've added a checker for valid `sample_rate` value. --- libavformat/svs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)