PR #25596 opened by Marvin Scholz (ePirat) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25596 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25596.patch
When parsing crafted SBG scripts containing 'NAN', `strtod()` returns NaN. When scaled, m evaluates to NaN. Relational comparisons against NaN evaluate to false, so `m` bypassed the range validation and was cast to int, triggering undefined behavior (float-cast-overflow). Validate with `isnan(m)` to prevent NaN from being cast to integer. >From ce60ee505d3594fbbcc24b8db7b0322769fef04c Mon Sep 17 00:00:00 2001 From: Marvin Scholz <[email protected]> Date: Thu, 29 Oct 2026 22:02:19 +0000 Subject: [PATCH] avformat/sbgdec: fix float cast overflow When parsing crafted SBG scripts containing 'NAN', strtod() returns NaN. When scaled, m evaluates to NaN. Relational comparisons against NaN evaluate to false, so m bypassed the range validation and was cast to int, triggering undefined behavior (float-cast-overflow). Validate with isnan(m) to prevent NaN from being cast to integer. Signed-off-by: Marvin Scholz <[email protected]> --- libavformat/sbgdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c index 24f7d5161d1..c78a5f4bbd4 100644 --- a/libavformat/sbgdec.c +++ b/libavformat/sbgdec.c @@ -217,9 +217,9 @@ static inline int is_space(char c) static inline int scale_double(void *log, double d, double m, int *r) { m *= d * SBG_SCALE; - if (m < INT_MIN || m >= INT_MAX) { + if (isnan(m) || m < INT_MIN || m >= INT_MAX) { if (log) - av_log(log, AV_LOG_ERROR, "%g is too large\n", d); + av_log(log, AV_LOG_ERROR, "%g is %s\n", d, isnan(m) ? "not a valid number" : "too large"); return AVERROR(EDOM); } *r = m; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
