PR #22999 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22999 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22999.patch
Found-by: Marius Momeu <[email protected]> >From 0882c5fa8637210ca7bb706d7a1964237e1018f2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 2 May 2026 12:57:48 +0200 Subject: [PATCH 1/3] libavformat/xwma: fix overflow in seek position Fixes: signed integer overflow Found-by: Marius Momeu <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/xwma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/xwma.c b/libavformat/xwma.c index b77c6ed605..d2333feb93 100644 --- a/libavformat/xwma.c +++ b/libavformat/xwma.c @@ -269,7 +269,7 @@ static int xwma_read_header(AVFormatContext *s) * an offset / timestamp pair. */ av_add_index_entry(st, - cur_pos + (i+1) * st->codecpar->block_align, /* pos */ + cur_pos + (i+1LL) * st->codecpar->block_align, /* pos */ dpds_table[i] / bytes_per_sample, /* timestamp */ st->codecpar->block_align, /* size */ 0, /* duration */ -- 2.52.0 >From a09dc50095b0b71f18a3f4c2317fb2e9171f437a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 2 May 2026 12:53:36 +0200 Subject: [PATCH 2/3] avcodec/adpcm: signed integer overflow in ADPCM_N64 Fixes: signed integer overflow Found-by: Marius Momeu <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/adpcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index 18bdc43b76..e06aa7606b 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -2704,7 +2704,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, AVFrame *frame, for (int k = i-1; k > -1; k--) { for (int o = 1; o < order; o++) - delta += sf_codes[(i-1) - k] * coefs[(o*8) + k]; + delta += sf_codes[(i-1) - k] * (unsigned)coefs[(o*8) + k]; } sample = sf_codes[i] * 2048; -- 2.52.0 >From 3a0f106e29a51a430b8b9e8f2dcb4398fb1c7af5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 2 May 2026 13:47:22 +0200 Subject: [PATCH 3/3] avformat/pcm: Use 64bit for byte_rate Fixes: integer overflow Found-by: Marius Momeu <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/pcm.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/libavformat/pcm.c b/libavformat/pcm.c index a774dbc372..bea3a1443d 100644 --- a/libavformat/pcm.c +++ b/libavformat/pcm.c @@ -74,7 +74,8 @@ int ff_pcm_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags) { AVStream *st; - int block_align, byte_rate; + int block_align; + int64_t byte_rate; int64_t pos, ret; st = s->streams[0]; @@ -82,9 +83,9 @@ int ff_pcm_read_seek(AVFormatContext *s, block_align = st->codecpar->block_align ? st->codecpar->block_align : (av_get_bits_per_sample(st->codecpar->codec_id) * st->codecpar->ch_layout.nb_channels) >> 3; byte_rate = st->codecpar->bit_rate ? st->codecpar->bit_rate >> 3 : - block_align * st->codecpar->sample_rate; + block_align * (int64_t)st->codecpar->sample_rate; - if (block_align <= 0 || byte_rate <= 0) + if (block_align <= 0 || byte_rate <= 0 || FFMAX(timestamp, st->time_base.num) > INT64_MAX / byte_rate) return -1; if (timestamp < 0) timestamp = 0; @@ -93,6 +94,9 @@ int ff_pcm_read_seek(AVFormatContext *s, st->time_base.num, st->time_base.den * (int64_t)block_align, (flags & AVSEEK_FLAG_BACKWARD) ? AV_ROUND_DOWN : AV_ROUND_UP); + + if (pos > (INT64_MAX - FFMAX(ffformatcontext(s)->data_offset, 0)) / block_align) + return -1; pos *= block_align; /* recompute exact position */ -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
