dilim/FFmpeg
1
0 Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-11-06 05:17:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/bsf/pcm_rechunk: reject channel counts that overflow the sample size

Browse Source 
Fixes: Zc8wjsgxLWvu
Fixes: AISLE-2026-0150-00562
Fixes: signed integer overflow, division by zero
Division by zero Replicated through UnModified FFmpeg with ASAN and UBSAN

Found-by: Joshua Rogers <joshua.rogers@aisle.com>
This commit is contained in:
Michael Niedermayer authored and michaelni committed 2026-11-03 16:12:58 +00:00
1 parent b8f159858e
commit 11052ca4b0
1 file changed
+4 -3
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/bsf/pcm_rechunk.c
+4 -3
View File
@@ -41,13 +41,14 @@ static int init(AVBSFContext *ctx)
PCMContext *s = ctx->priv_data;
AVRational sr = av_make_q(ctx->par_in->sample_rate, 1);
int64_t min_samples;
int bits_per_sample = av_get_bits_per_sample(ctx->par_in->codec_id);
if (ctx->par_in->ch_layout.nb_channels <= 0 || ctx->par_in->sample_rate <= 0)
if (ctx->par_in->ch_layout.nb_channels <= 0 || ctx->par_in->sample_rate <= 0 ||
ctx->par_in->ch_layout.nb_channels > INT_MAX / bits_per_sample)
return AVERROR(EINVAL);
ctx->time_base_out = av_inv_q(sr);
s->sample_size = ctx->par_in->ch_layout.nb_channels *
av_get_bits_per_sample(ctx->par_in->codec_id) / 8;
s->sample_size = ctx->par_in->ch_layout.nb_channels * bits_per_sample / 8;
if (s->frame_rate.num) {
min_samples = av_rescale_q_rnd(1, sr, s->frame_rate, AV_ROUND_DOWN);