[FFmpeg-devel] [PATCH 4/4] avcodec/utils: Check sample rate before use for AV_CODEC_ID_BINKAUDIO_DCT in get_audio_frame_duration()

[Michael Niedermayer]

On Wed, Oct 28, 2020 at 12:17:47PM +1100, Peter Ross wrote:
> On Tue, Oct 27, 2020 at 05:21:19PM +0100, Michael Niedermayer wrote:
> > Fixes: shift exponent 95 is too large for 32-bit type 'int'
> > Fixes: 26590/clusterfuzz-testcase-minimized-ffmpeg_dem_SMACKER_fuzzer-5120609937522688
> > 
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/utils.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/utils.c b/libavcodec/utils.c
> > index 93ac1cd9f0..3d978b390e 100644
> > --- a/libavcodec/utils.c
> > +++ b/libavcodec/utils.c
> > @@ -1633,8 +1633,11 @@ static int get_audio_frame_duration(enum AVCodecID id, int sr, int ch, int ba,
> >  
> >          if (ch > 0) {
> >              /* calc from sample rate and channels */
> > -            if (id == AV_CODEC_ID_BINKAUDIO_DCT)
> > +            if (id == AV_CODEC_ID_BINKAUDIO_DCT) {
> > +                if (sr / 22050 > 22)
> > +                    return 0;
> >                  return (480 << (sr / 22050)) / ch;
> > +            }
> >          }
> >  
> >          if (id == AV_CODEC_ID_MP3)
> 
> looks good

will apply

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Dictatorship naturally arises out of democracy, and the most aggravated
form of tyranny and slavery out of the most extreme liberty. -- Plato
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20201029/3b47ed43/attachment.sig>