diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-03-26 00:45:09 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-03-26 23:25:40 +0100 |
| commit | 75317ec4420d9853526291e8aa18f3ea17321525 (patch) | |
| tree | 2a8840589c26e86756f27cfc705a8db7db12f5c3 | |
| parent | 0bed22d597b78999151e3bde0768b7fe763fc2a6 (diff) | |
| download | ffmpeg-75317ec4420d9853526291e8aa18f3ea17321525.tar.gz | |
avformat/wavdec: sanity check channels and bps before using them for block_align
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-4704044498944000
Fixes: signed integer overflow: 520464 * 8224 cannot be represented in type 'int'
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/wavdec.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index 668c8adc36..89855670d9 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -34,6 +34,7 @@ #include "libavutil/log.h" #include "libavutil/mathematics.h" #include "libavutil/opt.h" +#include "libavcodec/internal.h" #include "avformat.h" #include "avio.h" #include "avio_internal.h" @@ -908,7 +909,9 @@ static int w64_read_header(AVFormatContext *s) if (ret < 0) return ret; avio_skip(pb, FFALIGN(size, INT64_C(8)) - size); - if (st->codecpar->block_align) { + if (st->codecpar->block_align && + st->codecpar->ch_layout.nb_channels < FF_SANE_NB_CHANNELS && + st->codecpar->bits_per_coded_sample < 128) { int block_align = st->codecpar->block_align; block_align = FFMAX(block_align, |