PR #24673 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24673 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24673.patch
Fixes: negative-size-param Fixes: signed integer overflow Fixes: jq3f1Nk2lzaK/testcase/dynaudnorm-overflow.wav Fixes: jq3f1Nk2lzaK Found-by: mzfr <[email protected]> >From fb6240a2fc686afef6a9e4a8a0dc014b2c7fe2c7 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 24 Sep 2026 00:53:36 +0200 Subject: [PATCH] avfilter/af_dynaudnorm: reject a frame length whose window does not fit an int Fixes: negative-size-param Fixes: signed integer overflow Fixes: jq3f1Nk2lzaK/testcase/dynaudnorm-overflow.wav Fixes: jq3f1Nk2lzaK Found-by: mzfr <[email protected]> --- libavfilter/af_dynaudnorm.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/libavfilter/af_dynaudnorm.c b/libavfilter/af_dynaudnorm.c index 938f99f75c..3e50b32087 100644 --- a/libavfilter/af_dynaudnorm.c +++ b/libavfilter/af_dynaudnorm.c @@ -172,7 +172,9 @@ static av_cold int init(AVFilterContext *ctx) static inline int frame_size(int sample_rate, int frame_len_msec) { - const int frame_size = lrint((double)sample_rate * (frame_len_msec / 1000.0)); + const int64_t frame_size = llrint((double)sample_rate * (frame_len_msec / 1000.0)); + if (frame_size >= INT_MAX / 2) + return AVERROR(EINVAL); return frame_size + (frame_size % 2); } @@ -350,6 +352,8 @@ static int config_input(AVFilterLink *inlink) s->channels = inlink->ch_layout.nb_channels; s->frame_len = frame_size(inlink->sample_rate, s->frame_len_msec); + if (s->frame_len < 0) + return s->frame_len; av_log(ctx, AV_LOG_DEBUG, "frame len %d\n", s->frame_len); s->prev_amplification_factor = av_malloc_array(inlink->ch_layout.nb_channels, sizeof(*s->prev_amplification_factor)); @@ -1001,7 +1005,10 @@ static int process_command(AVFilterContext *ctx, const char *cmd, const char *ar } } - s->frame_len = frame_size(inlink->sample_rate, s->frame_len_msec); + ret = frame_size(inlink->sample_rate, s->frame_len_msec); + if (ret < 0) + return ret; + s->frame_len = ret; s->sample_advance = FFMAX(1, lrint(s->frame_len * (1. - s->overlap))); if (s->expr_str) { ret = av_expr_parse(&s->expr, s->expr_str, var_names, NULL, NULL, -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
