PR #25062 opened by Zhao Zhili (quink) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25062 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25062.patch
# Summary of changes AAC, FLAC and IAMF PCM codec configs take their sample rate from the bitstream. Zero is not a usable rate, and an IAMF PCM rate above INT_MAX turns negative in the int field. The rate is an operand of av_rescale(). A negative value as the multiplier in param_parse() hits av_assert2(b >= 0), and a zero value as the divisor in mix_presentation_obu() hits av_assert2(c > 0). param_parse() reads parameter_rate from the bitstream and uses it as the divisor of av_rescale() when bounding the block duration, so a zero rate hits av_assert2(c > 0). <!-- If this PR requires new FATE test samples, attach them to the PR and list their target paths below (relative to the fate-suite root). Attached filenames must match the sample's filename: ```fate-samples # e.g. vorbis/new-sample.ogg ``` --> >From b12f71208b0c0be9bc034ddd6464e3a471811a18 Mon Sep 17 00:00:00 2001 From: Zhao Zhili <[email protected]> Date: Wed, 14 Oct 2026 13:13:09 +0800 Subject: [PATCH 1/2] avformat/iamf_parse: reject codec configs with an invalid sample rate AAC, FLAC and IAMF PCM codec configs take their sample rate from the bitstream. Zero is not a usable rate, and an IAMF PCM rate above INT_MAX turns negative in the int field. The rate is an operand of av_rescale(). A negative value as the multiplier in param_parse() hits av_assert2(b >= 0), and a zero value as the divisor in mix_presentation_obu() hits av_assert2(c > 0). Signed-off-by: Zhao Zhili <[email protected]> --- libavformat/iamf_parse.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index 892145cd87..b95c47ce8e 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -110,6 +110,8 @@ static int aac_decoder_config(IAMFCodecConfig *codec_config, return ret; codec_config->sample_rate = cfg.sample_rate; + if (codec_config->sample_rate <= 0) + return AVERROR_INVALIDDATA; return 0; } @@ -138,6 +140,8 @@ static int flac_decoder_config(IAMFCodecConfig *codec_config, codec_config->extradata_size = left; codec_config->sample_rate = AV_RB24(codec_config->extradata + 10) >> 4; + if (codec_config->sample_rate <= 0) + return AVERROR_INVALIDDATA; return 0; } @@ -154,8 +158,11 @@ static int ipcm_decoder_config(IAMFCodecConfig *codec_config, if (sample_format > 1 || sample_size > 2U || codec_config->audio_roll_distance) return AVERROR_INVALIDDATA; - codec_config->codec_id = sample_fmt[sample_format][sample_size]; codec_config->sample_rate = avio_rb32(pb); + if (codec_config->sample_rate <= 0) + return AVERROR_INVALIDDATA; + + codec_config->codec_id = sample_fmt[sample_format][sample_size]; if (len - avio_tell(pb)) return AVERROR_INVALIDDATA; -- 2.52.0 >From dc46eff03ad773ec46d63249875276f28df93ea0 Mon Sep 17 00:00:00 2001 From: Zhao Zhili <[email protected]> Date: Wed, 14 Oct 2026 15:15:07 +0800 Subject: [PATCH 2/2] avformat/iamf_parse: reject a zero parameter rate param_parse() reads parameter_rate from the bitstream and uses it as the divisor of av_rescale() when bounding the block duration, so a zero rate hits av_assert2(c > 0). Signed-off-by: Zhao Zhili <[email protected]> --- libavformat/iamf_parse.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c index b95c47ce8e..5338004d99 100644 --- a/libavformat/iamf_parse.c +++ b/libavformat/iamf_parse.c @@ -635,6 +635,8 @@ static int param_parse(void *s, IAMFContext *c, AVIOContext *pb, } parameter_rate = ffio_read_leb(pb); + if (!parameter_rate) + return AVERROR_INVALIDDATA; mode = avio_r8(pb) >> 7; if (mode == 0) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
