From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 10E4C4590F for ; Mon, 25 Sep 2023 11:28:13 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 5B72A68C960; Mon, 25 Sep 2023 14:28:08 +0300 (EEST) Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 5651A68C8E5 for ; Mon, 25 Sep 2023 14:28:02 +0300 (EEST) Received: from nick.intra.ispras.ru (unknown [10.10.34.56]) by mail.ispras.ru (Postfix) with ESMTPSA id 802D540F1DDF; Mon, 25 Sep 2023 11:28:01 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru 802D540F1DDF DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1695641281; bh=d1IjIWCO6S07dLbFVF73Eq6ZbEZ8cxbsbpzHrk/4csw=; h=From:To:Cc:Subject:Date:From; b=IU4Lf4tUipapN3vF3sLxZ81dg2BulGDmObbZWKoefKFgME9sPqYnNbG/qp8gFvSf6 4oZu6uvBxP/vGkcgIFvSiWqfTLmH3XwcHpXzac7uRqdN9x6ruS0o7rgQQNkvqMU8OW CM14a6hHLLk1CjZdQ+1EWz8pzv+mzvDC6SWaPwrU= From: mezhuevtp@ispras.ru To: ffmpeg-devel@ffmpeg.org Date: Mon, 25 Sep 2023 14:27:37 +0300 Message-Id: <20230925112737.4039135-1-mezhuevtp@ispras.ru> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] Numeric truncation in svs.c:57 X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: mezhuevtp@ispras.ru, headshog Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: From: headshog Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`. In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here. Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`. In a way not to break API/ABI, I've added a checker for valid `sample_rate` value. --- libavformat/svs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavformat/svs.c b/libavformat/svs.c index b91d29f5a6..54f24f539c 100644 --- a/libavformat/svs.c +++ b/libavformat/svs.c @@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s) { AVStream *st; uint32_t pitch; + int64_t rescale_val; + + rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF); + if (rescale_val > INT_MAX) + return AVERROR(ERANGE); st = avformat_new_stream(s, NULL); if (!st) @@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s) st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->codec_id = AV_CODEC_ID_ADPCM_PSX; st->codecpar->ch_layout = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO; - st->codecpar->sample_rate = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF); + st->codecpar->sample_rate = rescale_val; st->codecpar->block_align = 32; st->start_time = 0; if (s->pb->seekable & AVIO_SEEKABLE_NORMAL) -- 2.25.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".