[FFmpeg-devel] [PATCH] Numeric truncation in svs.c:57

[FFmpeg-devel] [PATCH] Numeric truncation in svs.c:57

[mezhuevtp]

From: headshog <craaaaaachind@gmail.com>

Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.
In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here.
Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`.
In a way not to break API/ABI, I've added a checker for valid `sample_rate` value.
---
 libavformat/svs.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavformat/svs.c b/libavformat/svs.c
index b91d29f5a6..54f24f539c 100644
--- a/libavformat/svs.c
+++ b/libavformat/svs.c
@@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
 {
     AVStream *st;
     uint32_t pitch;
+    int64_t rescale_val;
+
+    rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+    if (rescale_val > INT_MAX)
+        return AVERROR(ERANGE);
 
     st = avformat_new_stream(s, NULL);
     if (!st)
@@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
     st->codecpar->codec_type     = AVMEDIA_TYPE_AUDIO;
     st->codecpar->codec_id       = AV_CODEC_ID_ADPCM_PSX;
     st->codecpar->ch_layout      = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
-    st->codecpar->sample_rate    = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+    st->codecpar->sample_rate    = rescale_val;
     st->codecpar->block_align    = 32;
     st->start_time               = 0;
     if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
-- 
2.25.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] Numeric truncation in svs.c:57

[Andreas Rheinhardt]

mezhuevtp@ispras.ru:
> From: headshog <craaaaaachind@gmail.com>
> 
> Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.
> In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here.
> Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`.
> In a way not to break API/ABI, I've added a checker for valid `sample_rate` value.
> ---
>  libavformat/svs.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/libavformat/svs.c b/libavformat/svs.c
> index b91d29f5a6..54f24f539c 100644
> --- a/libavformat/svs.c
> +++ b/libavformat/svs.c
> @@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
>  {
>      AVStream *st;
>      uint32_t pitch;
> +    int64_t rescale_val;
> +
> +    rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);

Using an uninitialized variable is supposed to fix something?

> +    if (rescale_val > INT_MAX)
> +        return AVERROR(ERANGE);
>  
>      st = avformat_new_stream(s, NULL);
>      if (!st)
> @@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
>      st->codecpar->codec_type     = AVMEDIA_TYPE_AUDIO;
>      st->codecpar->codec_id       = AV_CODEC_ID_ADPCM_PSX;
>      st->codecpar->ch_layout      = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
> -    st->codecpar->sample_rate    = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
> +    st->codecpar->sample_rate    = rescale_val;
>      st->codecpar->block_align    = 32;
>      st->start_time               = 0;
>      if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".