" 1.
Interestingly, on the v8.0 static build, the process exits with an 'Invalid argument' error because it detects 0 channels, but the demuxer still incorrectly attempts to initialize a stream with those parameters." On Sat, Mar 28, 2026 at 11:31 AM Samyak Annapureddy < [email protected]> wrote: > This is My proposed Fix > Proposed Fix for libavformat/vpk.c > C > > static int vpk_read_header(AVFormatContext *s){ > VPKDemuxContext *vpk = s->priv_data; > unsigned offset; > AVStream *st; > int samples_per_block; > > vpk->last_block_size = 0; > st = avformat_new_stream(s, NULL); > if (!st) > return AVERROR(ENOMEM); > > avio_skip(s->pb, 4); // Skip "VPK " magic > offset = avio_rl32(s->pb); > avio_skip(s->pb, 4); > st->duration = avio_rl32(s->pb); > > /* FIX: Validate sample rate and channel count to prevent division by > zero */ > st->codecpar->sample_rate = avio_rl32(s->pb); > st->codecpar->ch_layout.nb_channels = avio_rl32(s->pb); > > if (st->codecpar->sample_rate <= 0 || st->codecpar->ch_layout.nb_channels > <= 0) { > av_log(s, AV_LOG_ERROR, "Invalid sample rate (%d) or channel count > (%d)\n", > st->codecpar->sample_rate, > st->codecpar->ch_layout.nb_channels); > return AVERROR_INVALIDDATA; > } > > // ... (rest of header parsing) ... > > /* FIX: Ensure samples_per_block is positive before calculation */ > samples_per_block = (vpk->block_size - 16 * > st->codecpar->ch_layout.nb_channels) * 2 / > st->codecpar->ch_layout.nb_channels; > > if (samples_per_block <= 0) { > av_log(s, AV_LOG_ERROR, "Invalid block size or channel count > resulting in non-positive samples per block\n"); > return AVERROR_INVALIDDATA; > } > > vpk->block_count = (st->duration + (samples_per_block - 1)) / > samples_per_block; > > return 0; > } > > ------------------------------ > Why this works: > > 1. > > *Immediate Return:* By checking sample_rate and nb_channels > immediately after they are read from avio_rl32, we prevent them from > propagating into any arithmetic operations. > 2. > > *Logic Guard:* The check for samples_per_block <= 0 is critical > because even if channels is positive, a small block_size relative to > the channel count could result in a zero or negative value, which would > still trigger the FPE in the vpk->block_count calculation. > 3. > > *FFmpeg Compliance:* Returning AVERROR_INVALIDDATA is the standard way > to handle malformed files in the FFmpeg ecosystem, ensuring the application > handles the error gracefully rather than crashing. > > > On Sat, Mar 28, 2026 at 11:27 AM Samyak Annapureddy < > [email protected]> wrote: > >> *Hello FFmpeg Developers,* >> >> I am reporting a Floating Point Exception (FPE) in the VPK demuxer ( >> libavformat/vpk.c) discovered via fuzzing. The crash occurs when >> processing a crafted 21-byte VPK file, likely due to an unvalidated header >> value causing a division by zero. >> >> *Reproduction:* >> >> 1. >> >> Build FFmpeg from the latest master (as of late March 2026). >> 2. >> >> Run the following command: ffmpeg -i [attached_crash_file] -f null - >> >> *Observed Result:* The process terminates with a Floating point >> exception: 8 (or UndefinedBehaviorSanitizer: division by zero). >> >> *Expected Result:* The demuxer should validate the header and return >> AVERROR_INVALIDDATA instead of crashing. >> >> *Hello FFmpeg Developers,* >> >> I have discovered a Floating Point Exception (division by zero) in the >> VPK demuxer (libavformat/vpk.c) using a fuzzer. The crash is triggered >> by the attached 21-byte PoC file. >> >> *Reproduction:* ffmpeg -i vpk_crash_poc -f null - >> >> *Tested on:* >> >> - >> >> *OS:* macOS (Apple Silicon) >> - >> >> *Git Hash:* f76aa4e4087569f99af1b4d87c04f160fb2378ce >> - >> >> *Result:* Floating point exception: 8 (or UndefinedBehaviorSanitizer: >> division by zero) >> >> *Analysis:* The crash appears to occur during header parsing where a >> sample rate or channel count of zero is not properly validated before being >> used in a division operation. >> >> Please see the attached 21-byte PoC file. >> >> *Best regards,* Samyak >> >> >> CRASH FILE : >> >> >> _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
