From 3fece4fad440b09fb212dbf9293bc19cbb5feb59 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 10 Oct 2026 04:50:50 +0200 Subject: [PATCH] avformat/wavdec: saturate the next tag offset after a saturated RF64 data end Signed integer overflow Replicated through API with UBSAN Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'int64_t' Fixes: 538780590/clusterfuzz-testcase-minimized-ffmpeg_dem_WAV_fuzzer-5528579277651968 Fixes: LkQQ7nojUzdg Regression since: 5bbc00c05d6e78542d09bb56c55759ce6b53c139 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer --- libavformat/wavdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index 8d19e52ead..d1f061d65b 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -468,7 +468,7 @@ static int wav_read_header(AVFormatContext *s) if (rf64 || bw64) { wav->data_end = av_sat_add64(avio_tell(pb), data_size); - next_tag_ofs = wav->data_end + (data_size & 1); + next_tag_ofs = av_sat_add64(wav->data_end, data_size & 1); } else if (size > 0 && size != 0xFFFFFFFF) { data_size = size; wav->data_end = avio_tell(pb) + size;