This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch release/8.0
in repository ffmpeg.

commit 0c602b96894f701a2e5f825c4a703971eb29fc50
Author:     Michael Niedermayer <[email protected]>
AuthorDate: Sat May 2 13:47:22 2026 +0200
Commit:     Michael Niedermayer <[email protected]>
CommitDate: Sun May 3 19:57:05 2026 +0200

    avformat/pcm: Use 64bit for byte_rate
    
    Fixes: integer overflow
    
    Found-by: Marius Momeu <[email protected]>
    Signed-off-by: Michael Niedermayer <[email protected]>
    (cherry picked from commit 9d9250e5dae12e6b4ceebd8f152bb5bdcabe1d0b)
    Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/pcm.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/libavformat/pcm.c b/libavformat/pcm.c
index a774dbc372..bea3a1443d 100644
--- a/libavformat/pcm.c
+++ b/libavformat/pcm.c
@@ -74,7 +74,8 @@ int ff_pcm_read_seek(AVFormatContext *s,
                      int stream_index, int64_t timestamp, int flags)
 {
     AVStream *st;
-    int block_align, byte_rate;
+    int block_align;
+    int64_t byte_rate;
     int64_t pos, ret;
 
     st = s->streams[0];
@@ -82,9 +83,9 @@ int ff_pcm_read_seek(AVFormatContext *s,
     block_align = st->codecpar->block_align ? st->codecpar->block_align :
         (av_get_bits_per_sample(st->codecpar->codec_id) * 
st->codecpar->ch_layout.nb_channels) >> 3;
     byte_rate = st->codecpar->bit_rate ? st->codecpar->bit_rate >> 3 :
-        block_align * st->codecpar->sample_rate;
+        block_align * (int64_t)st->codecpar->sample_rate;
 
-    if (block_align <= 0 || byte_rate <= 0)
+    if (block_align <= 0 || byte_rate <= 0 || FFMAX(timestamp, 
st->time_base.num) > INT64_MAX / byte_rate)
         return -1;
     if (timestamp < 0) timestamp = 0;
 
@@ -93,6 +94,9 @@ int ff_pcm_read_seek(AVFormatContext *s,
                          st->time_base.num,
                          st->time_base.den * (int64_t)block_align,
                          (flags & AVSEEK_FLAG_BACKWARD) ? AV_ROUND_DOWN : 
AV_ROUND_UP);
+
+    if (pos > (INT64_MAX - FFMAX(ffformatcontext(s)->data_offset, 0)) / 
block_align)
+        return -1;
     pos *= block_align;
 
     /* recompute exact position */

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to