sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avformat/wavdec: saturate the next tag offset after a saturated RF64 data end

Browse Source 
Signed integer overflow Replicated through API with UBSAN

Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'int64_t'
Fixes: 538780590/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5528579277651968
Fixes: LkQQ7nojUzdg
Regression since: 5bbc00c05d

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-10-10 04:50:50 +02:00
committed by michaelni
parent 8f48624cdb
commit 3fece4fad4
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/wavdec.c
View File

@@ -468,7 +468,7 @@ static int wav_read_header(AVFormatContext *s)
if (rf64 || bw64) {
wav->data_end = av_sat_add64(avio_tell(pb), data_size);
next_tag_ofs = wav->data_end + (data_size & 1);
next_tag_ofs = av_sat_add64(wav->data_end, data_size & 1);
} else if (size > 0 && size != 0xFFFFFFFF) {
data_size = size;
wav->data_end = avio_tell(pb) + size;