[FFmpeg-devel] [PATCH 03/11] avcodec/utils: Check sample_rate before opening decoder

[James Almer]

On 9/27/2019 2:23 PM, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 2 * -1306460384 cannot be represented in type 'int'
> Fixes: 17685/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_fuzzer-5747390337777664
> Fixes: 17688/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5739287210885120
> Fixes: 17699/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INTERPLAY_ACM_fuzzer-5678394531905536
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/utils.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/libavcodec/utils.c b/libavcodec/utils.c
> index a19e0086cb..abb2c76924 100644
> --- a/libavcodec/utils.c
> +++ b/libavcodec/utils.c
> @@ -970,6 +970,10 @@ FF_ENABLE_DEPRECATION_WARNINGS
>              ret = AVERROR(EINVAL);
>              goto free_and_end;
>          }
> +        if (avctx->sample_rate < 0) {
> +            ret = AVERROR(EINVAL);
> +            goto free_and_end;
> +        }
>          if (avctx->bits_per_coded_sample < 0) {
>              ret = AVERROR(EINVAL);
>              goto free_and_end;

Should be ok.