mezhue...@ispras.ru: > From: headshog <craaaaaach...@gmail.com> > > Hi! We've been fuzzing `ffmpeg` with > [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and > we found numeric truncation error in `svs.c:57`. > In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` > has type `int`, the type of return value in `av_rescale_rnd` function is > `int64_t`, so the numeric truncation may occur here. > Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` > function parameter `unsgined int pts_den`. > In a way not to break API/ABI, I've added a checker for valid `sample_rate` > value. > --- > libavformat/svs.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/libavformat/svs.c b/libavformat/svs.c > index b91d29f5a6..54f24f539c 100644 > --- a/libavformat/svs.c > +++ b/libavformat/svs.c > @@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s) > { > AVStream *st; > uint32_t pitch; > + int64_t rescale_val; > + > + rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
Using an uninitialized variable is supposed to fix something? > + if (rescale_val > INT_MAX) > + return AVERROR(ERANGE); > > st = avformat_new_stream(s, NULL); > if (!st) > @@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s) > st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; > st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX; > st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO; > - st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, > AV_ROUND_INF); > + st->codecpar->sample_rate = rescale_val; > st->codecpar->block_align = 32; > st->start_time = 0; > if (s->pb->seekable & AVIO_SEEKABLE_NORMAL) _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
