PR #22999 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22999
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22999.patch

Found-by: Marius Momeu <[email protected]>


>From 0882c5fa8637210ca7bb706d7a1964237e1018f2 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Sat, 2 May 2026 12:57:48 +0200
Subject: [PATCH 1/3] libavformat/xwma: fix overflow in seek position

Fixes: signed integer overflow

Found-by: Marius Momeu <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/xwma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/xwma.c b/libavformat/xwma.c
index b77c6ed605..d2333feb93 100644
--- a/libavformat/xwma.c
+++ b/libavformat/xwma.c
@@ -269,7 +269,7 @@ static int xwma_read_header(AVFormatContext *s)
              * an offset / timestamp pair.
              */
             av_add_index_entry(st,
-                               cur_pos + (i+1) * st->codecpar->block_align, /* 
pos */
+                               cur_pos + (i+1LL) * st->codecpar->block_align, 
/* pos */
                                dpds_table[i] / bytes_per_sample,            /* 
timestamp */
                                st->codecpar->block_align,                   /* 
size */
                                0,                                           /* 
duration */
-- 
2.52.0


>From a09dc50095b0b71f18a3f4c2317fb2e9171f437a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Sat, 2 May 2026 12:53:36 +0200
Subject: [PATCH 2/3] avcodec/adpcm: signed integer overflow in ADPCM_N64

Fixes: signed integer overflow

Found-by: Marius Momeu <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavcodec/adpcm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index 18bdc43b76..e06aa7606b 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -2704,7 +2704,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, 
AVFrame *frame,
 
                     for (int k = i-1; k > -1; k--) {
                         for (int o = 1; o < order; o++)
-                            delta += sf_codes[(i-1) - k] * coefs[(o*8) + k];
+                            delta += sf_codes[(i-1) - k] * 
(unsigned)coefs[(o*8) + k];
                     }
 
                     sample = sf_codes[i] * 2048;
-- 
2.52.0


>From 3a0f106e29a51a430b8b9e8f2dcb4398fb1c7af5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Sat, 2 May 2026 13:47:22 +0200
Subject: [PATCH 3/3] avformat/pcm: Use 64bit for byte_rate

Fixes: integer overflow

Found-by: Marius Momeu <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavformat/pcm.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/libavformat/pcm.c b/libavformat/pcm.c
index a774dbc372..bea3a1443d 100644
--- a/libavformat/pcm.c
+++ b/libavformat/pcm.c
@@ -74,7 +74,8 @@ int ff_pcm_read_seek(AVFormatContext *s,
                      int stream_index, int64_t timestamp, int flags)
 {
     AVStream *st;
-    int block_align, byte_rate;
+    int block_align;
+    int64_t byte_rate;
     int64_t pos, ret;
 
     st = s->streams[0];
@@ -82,9 +83,9 @@ int ff_pcm_read_seek(AVFormatContext *s,
     block_align = st->codecpar->block_align ? st->codecpar->block_align :
         (av_get_bits_per_sample(st->codecpar->codec_id) * 
st->codecpar->ch_layout.nb_channels) >> 3;
     byte_rate = st->codecpar->bit_rate ? st->codecpar->bit_rate >> 3 :
-        block_align * st->codecpar->sample_rate;
+        block_align * (int64_t)st->codecpar->sample_rate;
 
-    if (block_align <= 0 || byte_rate <= 0)
+    if (block_align <= 0 || byte_rate <= 0 || FFMAX(timestamp, 
st->time_base.num) > INT64_MAX / byte_rate)
         return -1;
     if (timestamp < 0) timestamp = 0;
 
@@ -93,6 +94,9 @@ int ff_pcm_read_seek(AVFormatContext *s,
                          st->time_base.num,
                          st->time_base.den * (int64_t)block_align,
                          (flags & AVSEEK_FLAG_BACKWARD) ? AV_ROUND_DOWN : 
AV_ROUND_UP);
+
+    if (pos > (INT64_MAX - FFMAX(ffformatcontext(s)->data_offset, 0)) / 
block_align)
+        return -1;
     pos *= block_align;
 
     /* recompute exact position */
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to