ffmpeg | branch: release/7.1 | Michael Niedermayer <mich...@niedermayer.cc> | Sun May 11 23:18:19 2025 +0200| [ebcd40e701a194edca5bd2f4a8e5262aa6ab1841] | committer: Michael Niedermayer
avformat/matroskadec: check that channels fit in signed 32bit int Fixes: signed integer overflow: -1384566925600903168 * 16 cannot be represented in type 'long' Fixes: 407069502/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-5159255372267520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> (cherry picked from commit 05f8c8c4c2b8f3a0b206ecb7e1b5bba68a9820b8) Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ebcd40e701a194edca5bd2f4a8e5262aa6ab1841 --- libavformat/matroskadec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 105a90a937..b6af422a4d 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -2843,6 +2843,8 @@ static int mka_parse_audio(MatroskaTrack *track, AVStream *st, par->sample_rate = track->audio.out_samplerate; // channel layout may be already set by codec private checks above if (!av_channel_layout_check(&par->ch_layout)) { + if (track->audio.channels > INT32_MAX) + return AVERROR_PATCHWELCOME; par->ch_layout.order = AV_CHANNEL_ORDER_UNSPEC; par->ch_layout.nb_channels = track->audio.channels; } _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
