Re: [FFmpeg-devel] [PATCH] Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.

[Andreas Rheinhardt <andreas.rheinhardt@outlook.com>]

mezhuevtp@ispras.ru:
> From: headshog <craaaaaachind@gmail.com>
> 
> In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `uint64_t`, so the numeric truncation may occur here. Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`. In this function `pts_den` is used only in passing its value to parameter `int64_t den` in function `av_reduce`. So we suggest to change the type of field `sample_rate` to `int64_t` and to change the type of `pts_den` to `uint64_t` in `avpriv_set_pts_info` function. The other way to solve this is to add a checker for `sample_rate` valid value.
> 
> - OS: ubuntu 20.04
> - commit: f225f8d7464569c7b917015c26ad30a37a5fbbe2
> 
> ```
> libavformat/svs.c:57:36: runtime error: implicit conversion from type 'int64_t' (aka 'long') of value 6321554672 (64-bit, signed) to type 'int' changed the value to 2026587376 (32-bit, signed)
> SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavformat/svs.c:57:36

Truncation via implicit conversions is not undefined behavior (but it
may be a bug).

- Andreas

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".