From: headshog <craaaaaach...@gmail.com>
Hi! We've been fuzzing `ffmpeg` with
[sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we
found numeric truncation error in `svs.c:57`.
In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has
type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`,
so the numeric truncation may occur here.
Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info`
function parameter `unsgined int pts_den`.
In a way not to break API/ABI, I've added a checker for valid `sample_rate`
value.
---
libavformat/svs.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/libavformat/svs.c b/libavformat/svs.c
index b91d29f5a6..54f24f539c 100644
--- a/libavformat/svs.c
+++ b/libavformat/svs.c
@@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
{
AVStream *st;
uint32_t pitch;
+ int64_t rescale_val;
+
+ rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+ if (rescale_val > INT_MAX)
+ return AVERROR(ERANGE);
st = avformat_new_stream(s, NULL);
if (!st)
@@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX;
st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
- st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096,
AV_ROUND_INF);
+ st->codecpar->sample_rate = rescale_val;
st->codecpar->block_align = 32;
st->start_time = 0;
if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
--
2.25.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
