[FFmpeg-devel] [PATCH] Numeric truncation in svs.c:57

[mezhuevtp at ispras.ru]

From: headshog <craaaaaachind at gmail.com>

Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.
In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here.
Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`.
In a way not to break API/ABI, I've added a checker for valid `sample_rate` value.
---
 libavformat/svs.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavformat/svs.c b/libavformat/svs.c
index b91d29f5a6..54f24f539c 100644
--- a/libavformat/svs.c
+++ b/libavformat/svs.c
@@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
 {
     AVStream *st;
     uint32_t pitch;
+    int64_t rescale_val;
+
+    rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+    if (rescale_val > INT_MAX)
+        return AVERROR(ERANGE);
 
     st = avformat_new_stream(s, NULL);
     if (!st)
@@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
     st->codecpar->codec_type     = AVMEDIA_TYPE_AUDIO;
     st->codecpar->codec_id       = AV_CODEC_ID_ADPCM_PSX;
     st->codecpar->ch_layout      = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
-    st->codecpar->sample_rate    = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
+    st->codecpar->sample_rate    = rescale_val;
     st->codecpar->block_align    = 32;
     st->start_time               = 0;
     if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)
-- 
2.25.1