From 11052ca4b01b021a135ec89ed7e86aa96dd3bf33 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 28 Oct 2026 23:59:58 +0100 Subject: [PATCH] avcodec/bsf/pcm_rechunk: reject channel counts that overflow the sample size Fixes: Zc8wjsgxLWvu Fixes: AISLE-2026-0150-00562 Fixes: signed integer overflow, division by zero Division by zero Replicated through UnModified FFmpeg with ASAN and UBSAN Found-by: Joshua Rogers --- libavcodec/bsf/pcm_rechunk.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavcodec/bsf/pcm_rechunk.c b/libavcodec/bsf/pcm_rechunk.c index 0c1007e271..3f7d01226c 100644 --- a/libavcodec/bsf/pcm_rechunk.c +++ b/libavcodec/bsf/pcm_rechunk.c @@ -41,13 +41,14 @@ static int init(AVBSFContext *ctx) PCMContext *s = ctx->priv_data; AVRational sr = av_make_q(ctx->par_in->sample_rate, 1); int64_t min_samples; + int bits_per_sample = av_get_bits_per_sample(ctx->par_in->codec_id); - if (ctx->par_in->ch_layout.nb_channels <= 0 || ctx->par_in->sample_rate <= 0) + if (ctx->par_in->ch_layout.nb_channels <= 0 || ctx->par_in->sample_rate <= 0 || + ctx->par_in->ch_layout.nb_channels > INT_MAX / bits_per_sample) return AVERROR(EINVAL); ctx->time_base_out = av_inv_q(sr); - s->sample_size = ctx->par_in->ch_layout.nb_channels * - av_get_bits_per_sample(ctx->par_in->codec_id) / 8; + s->sample_size = ctx->par_in->ch_layout.nb_channels * bits_per_sample / 8; if (s->frame_rate.num) { min_samples = av_rescale_q_rnd(1, sr, s->frame_rate, AV_ROUND_DOWN);