This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 2b7e501242 avformat/codec2: avoid integer overflow in packet size and
duration
2b7e501242 is described below
commit 2b7e5012424a52998cd6a1fe3556272313cb7527
Author: Michael Niedermayer <[email protected]>
AuthorDate: Sat Jul 11 21:21:57 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Wed Jul 29 02:03:25 2026 +0000
avformat/codec2: avoid integer overflow in packet size and duration
Fixes: signed integer overflow
Fixes: 2jy_poc_codec2.zip / poc_codec2.raw
Fixes: jOQASNnOm6O7
Found-by: Jiale Yao <[email protected]>
---
libavformat/codec2.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavformat/codec2.c b/libavformat/codec2.c
index dcc3ed9e59..0791b61b35 100644
--- a/libavformat/codec2.c
+++ b/libavformat/codec2.c
@@ -198,6 +198,8 @@ static int codec2_read_packet(AVFormatContext *s, AVPacket
*pkt)
}
//try to read desired number of frames, compute n from to actual number of
bytes read
+ if (c2->frames_per_packet > INT_MAX / block_align)
+ return AVERROR(EINVAL);
size = c2->frames_per_packet * block_align;
ret = av_get_packet(s->pb, pkt, size);
if (ret < 0) {
@@ -207,7 +209,7 @@ static int codec2_read_packet(AVFormatContext *s, AVPacket
*pkt)
//only set duration - compute_pkt_fields() and ff_pcm_read_seek() takes
care of everything else
//tested by spamming the seek functionality in ffplay
n = ret / block_align;
- pkt->duration = n * frame_size;
+ pkt->duration = (int64_t)n * frame_size;
return ret;
}
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
