[FFmpeg-devel] [PATCH 1/4] avformat/wvdec: Check rate for overflow

[Paul B Mahol]

On Sun, Sep 20, 2020 at 10:26:05PM +0200, Michael Niedermayer wrote:
> Fixes: signed integer overflow: 6000 * -2147483648 cannot be represented in type 'int'
> Fixes: 25700/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6578316302352384
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavformat/wvdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/wvdec.c b/libavformat/wvdec.c
> index b9fc6a59f9..b7d8dbbe78 100644
> --- a/libavformat/wvdec.c
> +++ b/libavformat/wvdec.c
> @@ -192,7 +192,7 @@ static int wv_read_block_header(AVFormatContext *ctx, AVIOContext *pb)
>              if (id & 0x40)
>                  avio_skip(pb, 1);
>          }
> -        if (rate == -1) {
> +        if (rate == -1 || rate * (uint64_t)rate_x >= INT_MAX) {
>              av_log(ctx, AV_LOG_ERROR,

AFAIK rate_x should be unsigned type from start.
rate_x can be max (1U << 31)
Otherwise patch is acceptable.

>                     "Cannot determine custom sampling rate\n");
>              return AVERROR_INVALIDDATA;
> -- 
> 2.17.1
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".