| Message ID | 20240326001151.12083-7-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 75317ec4420d9853526291e8aa18f3ea17321525 |
| Headers | show |
| Series | [FFmpeg-devel,01/10] avformat/concatdec: Check user_duration sum | expand |
| Context | Check | Description |
|---|---|---|
| andriy/configure_x86 | warning | Failed to apply patch |
| yinshiyou/configure_loongarch64 | warning | Failed to apply patch |
Quoting Michael Niedermayer (2024-03-26 01:11:48) > Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-4704044498944000 > Fixes: signed integer overflow: 520464 * 8224 cannot be represented in type 'int' > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/wavdec.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c > index 668c8adc36b..89855670d9c 100644 > --- a/libavformat/wavdec.c > +++ b/libavformat/wavdec.c > @@ -34,6 +34,7 @@ > #include "libavutil/log.h" > #include "libavutil/mathematics.h" > #include "libavutil/opt.h" > +#include "libavcodec/internal.h" > #include "avformat.h" > #include "avio.h" > #include "avio_internal.h" > @@ -908,7 +909,9 @@ static int w64_read_header(AVFormatContext *s) > if (ret < 0) > return ret; > avio_skip(pb, FFALIGN(size, INT64_C(8)) - size); > - if (st->codecpar->block_align) { > + if (st->codecpar->block_align && > + st->codecpar->ch_layout.nb_channels < FF_SANE_NB_CHANNELS && I objected to this approach.
On Wed, Mar 27, 2024 at 10:42:31AM +0100, Anton Khirnov wrote: > Quoting Michael Niedermayer (2024-03-26 01:11:48) > > Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-4704044498944000 > > Fixes: signed integer overflow: 520464 * 8224 cannot be represented in type 'int' > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/wavdec.c | 5 ++++- > > 1 file changed, 4 insertions(+), 1 deletion(-) > > > > diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c > > index 668c8adc36b..89855670d9c 100644 > > --- a/libavformat/wavdec.c > > +++ b/libavformat/wavdec.c > > @@ -34,6 +34,7 @@ > > #include "libavutil/log.h" > > #include "libavutil/mathematics.h" > > #include "libavutil/opt.h" > > +#include "libavcodec/internal.h" > > #include "avformat.h" > > #include "avio.h" > > #include "avio_internal.h" > > @@ -908,7 +909,9 @@ static int w64_read_header(AVFormatContext *s) > > if (ret < 0) > > return ret; > > avio_skip(pb, FFALIGN(size, INT64_C(8)) - size); > > - if (st->codecpar->block_align) { > > + if (st->codecpar->block_align && > > + st->codecpar->ch_layout.nb_channels < FF_SANE_NB_CHANNELS && > > I objected to this approach. Maybe that was your intend but what you actually wrote and what i understood was that you objected to adding a field to AVFormatContext For reference: > is anyone against adding a max_channels field to AVFormatContext or something > like that ? I am. [...]
diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index 668c8adc36b..89855670d9c 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -34,6 +34,7 @@ #include "libavutil/log.h" #include "libavutil/mathematics.h" #include "libavutil/opt.h" +#include "libavcodec/internal.h" #include "avformat.h" #include "avio.h" #include "avio_internal.h" @@ -908,7 +909,9 @@ static int w64_read_header(AVFormatContext *s) if (ret < 0) return ret; avio_skip(pb, FFALIGN(size, INT64_C(8)) - size); - if (st->codecpar->block_align) { + if (st->codecpar->block_align && + st->codecpar->ch_layout.nb_channels < FF_SANE_NB_CHANNELS && + st->codecpar->bits_per_coded_sample < 128) { int block_align = st->codecpar->block_align; block_align = FFMAX(block_align,
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-4704044498944000 Fixes: signed integer overflow: 520464 * 8224 cannot be represented in type 'int' Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/wavdec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)