Following up on the VPK demuxer Floating Point Exception I reported earlier, I have authored a patch to address the root cause.
The crash was triggered by a lack of validation for sample_rate and nb_channels. This patch: 1. Adds bounds checks to ensure sample_rate and nb_channels are positive. 2. Includes a safety check for the samples_per_block calculation to prevent it from being used as a zero or negative divisor for block_count. 3. Adds an av_log error message to help identify malformed files. The patch is attached in git format-patch format. I have verified it against the 21-byte PoC, and FFmpeg now exits gracefully with AVERROR_INVALIDDATA instead of crashing. Best regards, Samyak Annapureddy On Sat, Mar 28, 2026 at 11:27 AM Samyak Annapureddy < [email protected]> wrote: > *Hello FFmpeg Developers,* > > I am reporting a Floating Point Exception (FPE) in the VPK demuxer ( > libavformat/vpk.c) discovered via fuzzing. The crash occurs when > processing a crafted 21-byte VPK file, likely due to an unvalidated header > value causing a division by zero. > > *Reproduction:* > > 1. > > Build FFmpeg from the latest master (as of late March 2026). > 2. > > Run the following command: ffmpeg -i [attached_crash_file] -f null - > > *Observed Result:* The process terminates with a Floating point > exception: 8 (or UndefinedBehaviorSanitizer: division by zero). > > *Expected Result:* The demuxer should validate the header and return > AVERROR_INVALIDDATA instead of crashing. > > *Hello FFmpeg Developers,* > > I have discovered a Floating Point Exception (division by zero) in the VPK > demuxer (libavformat/vpk.c) using a fuzzer. The crash is triggered by the > attached 21-byte PoC file. > > *Reproduction:* ffmpeg -i vpk_crash_poc -f null - > > *Tested on:* > > - > > *OS:* macOS (Apple Silicon) > - > > *Git Hash:* f76aa4e4087569f99af1b4d87c04f160fb2378ce > - > > *Result:* Floating point exception: 8 (or UndefinedBehaviorSanitizer: > division by zero) > > *Analysis:* The crash appears to occur during header parsing where a > sample rate or channel count of zero is not properly validated before being > used in a division operation. > > Please see the attached 21-byte PoC file. > > *Best regards,* Samyak > > > CRASH FILE : > > >
0001-avformat-vpk-fix-division-by-zero-and-samples_per_bl.patch
Description: Binary data
_______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
