diff mbox series

[FFmpeg-devel,3/7] avcodec/ratecontrol: Handle wanted bits overflow

Message ID 20240618134826.2189719-3-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/7] avcodec/utils: apply the same alignment to YUV410 as we do to YUV420 when motion estimation is used | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer June 18, 2024, 1:48 p.m. UTC 
Fixes: 5.92611e+20 is outside the range of representable values of type 'unsigned long'
Fixes: 68984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5155755073273856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/ratecontrol.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/libavcodec/ratecontrol.c b/libavcodec/ratecontrol.c
index df27639ca73..86ec7a3443e 100644
--- a/libavcodec/ratecontrol.c
+++ b/libavcodec/ratecontrol.c
@@ -936,6 +936,7 @@  float ff_rate_estimate_qscale(MpegEncContext *s, int dry_run)
         wanted_bits = rce->expected_bits;
     } else {
         const MPVPicture *dts_pic;
+        double wanted_bits_double;
         rce = &local_rce;
 
         /* FIXME add a dts field to AVFrame and ensure it is set and use it
@@ -947,9 +948,14 @@  float ff_rate_estimate_qscale(MpegEncContext *s, int dry_run)
             dts_pic = s->last_pic.ptr;
 
         if (!dts_pic || dts_pic->f->pts == AV_NOPTS_VALUE)
-            wanted_bits = (uint64_t)(s->bit_rate * (double)picture_number / fps);
+            wanted_bits_double = s->bit_rate * (double)picture_number / fps;
         else
-            wanted_bits = (uint64_t)(s->bit_rate * (double)dts_pic->f->pts / fps);
+            wanted_bits_double = s->bit_rate * (double)dts_pic->f->pts / fps;
+        if (wanted_bits_double > INT64_MAX) {
+            av_log(s, AV_LOG_WARNING, "Bits exceed 64bit range\n");
+            wanted_bits = INT64_MAX;
+        } else
+            wanted_bits = (int64_t)wanted_bits_double;
     }
 
     diff = s->total_bits - wanted_bits;