PR #25601 opened by Marvin Scholz (ePirat) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25601 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25601.patch
Validate `duration`, `videodatarate`, and `audiodatarate` in `amf_parse_object()` before converting double values to `int64_t`, preventing float-cast-overflow undefined behavior on `NaN`, negative, infinite, or out-of-range values. >From be582c6eba043e7175b9a99d0be59e7c3acc6f7e Mon Sep 17 00:00:00 2001 From: Marvin Scholz <[email protected]> Date: Fri, 23 Oct 2026 14:29:58 +0000 Subject: [PATCH] avformat/flvdec: prevent float-cast-overflow in amf_parse_object Validate duration, videodatarate, and audiodatarate in amf_parse_object() before converting double values to int64_t, preventing float-cast-overflow undefined behavior on NaN, negative, infinite, or out-of-range values. Signed-off-by: Marvin Scholz <[email protected]> --- libavformat/flvdec.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 29bd7d6754c..04b60f49e61 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -719,13 +719,14 @@ static int amf_parse_object(AVFormatContext *s, AVStream *astream, if (depth == 1) { if (amf_type == AMF_DATA_TYPE_NUMBER || amf_type == AMF_DATA_TYPE_BOOL) { - if (!strcmp(key, "duration")) + if (!strcmp(key, "duration") && + num_val > 0 && num_val < INT64_MAX / AV_TIME_BASE) s->duration = num_val * AV_TIME_BASE; else if (!strcmp(key, "videodatarate") && - 0 <= (int)(num_val * 1024.0)) + 0 <= num_val && num_val < INT_MAX / 1024.0) flv->video_bit_rate = num_val * 1024.0; else if (!strcmp(key, "audiodatarate") && - 0 <= (int)(num_val * 1024.0)) + 0 <= num_val && num_val < INT_MAX / 1024.0) flv->audio_bit_rate = num_val * 1024.0; else if (!strcmp(key, "framerate")) { flv->framerate = av_d2q(num_val, 1000); -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
