PR #24672 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24672 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24672.patch
Fixes: out of array access Fixes: signed integer overflow Fixes: pkKQIDVxuWvP/testcase/alimiter-overflow.wav Fixes: pkKQIDVxuWvP Found-by: mzfr <[email protected]> >From a1ea556470d91c96ec3cf30e37dd1f679d4a95a4 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 24 Sep 2026 00:50:13 +0200 Subject: [PATCH] avfilter/af_alimiter: compute the buffer size without int overflow Fixes: out of array access Fixes: signed integer overflow Fixes: pkKQIDVxuWvP/testcase/alimiter-overflow.wav Fixes: pkKQIDVxuWvP Found-by: mzfr <[email protected]> --- libavfilter/af_alimiter.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavfilter/af_alimiter.c b/libavfilter/af_alimiter.c index 61ea7beb6f..8ef6d74afd 100644 --- a/libavfilter/af_alimiter.c +++ b/libavfilter/af_alimiter.c @@ -360,10 +360,10 @@ static int config_input(AVFilterLink *inlink) { AVFilterContext *ctx = inlink->dst; AudioLimiterContext *s = ctx->priv; - int obuffer_size; + int64_t obuffer_size; - obuffer_size = inlink->sample_rate * inlink->ch_layout.nb_channels * 100 / 1000. + inlink->ch_layout.nb_channels; - if (obuffer_size < inlink->ch_layout.nb_channels) + obuffer_size = inlink->sample_rate * (int64_t)inlink->ch_layout.nb_channels / 10 + inlink->ch_layout.nb_channels; + if (obuffer_size > INT_MAX) return AVERROR(EINVAL); s->buffer = av_calloc(obuffer_size, sizeof(*s->buffer)); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
