[FFmpeg-devel] [PR] avcodec/adpcm: fix integer overflow in N64 (PR #21753)

[FFmpeg-devel] [PR] avcodec/adpcm: fix integer overflow in N64 (PR #21753)

[michaelni via ffmpeg-devel]

PR #21753 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21753
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21753.patch

Fixes: signed integer overflow: 1077919680 + 1077936128 cannot be represented in type 'int'
Fixes: 471686763/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_N64_DEC_fuzzer-6493712281829376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From a802ef96e5e6e96976c5443f81fd92f06f8bb540 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sat, 14 Feb 2026 01:32:40 +0100
Subject: [PATCH] avcodec/adpcm: fix integer overflow in N64

Fixes: signed integer overflow: 1077919680 + 1077936128 cannot be represented in type 'int'
Fixes: 471686763/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_N64_DEC_fuzzer-6493712281829376

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/adpcm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index 8ddca46b67..1502a5cb04 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -2688,7 +2688,8 @@ static int adpcm_decode_frame(AVCodecContext *avctx, AVFrame *frame,
                 int16_t *sf_out = &out[j*8];
 
                 for (int i = 0; i < 8; i++) {
-                    int sample, delta = 0;
+                    int sample;
+                    unsigned delta = 0;
 
                     for (int o = 0; o < order; o++)
                         delta += coefs[o*8 + i] * hist[(8 - order) + o];
@@ -2699,7 +2700,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, AVFrame *frame,
                     }
 
                     sample = sf_codes[i] * 2048;
-                    sample = (sample + delta) / 2048;
+                    sample = (int)(sample + delta) / 2048;
                     sample = av_clip_int16(sample);
                     sf_out[i] = sample;
                 }
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org