This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 4af563686fa283e2e6138e38c3d72e91c9bdf851 Author: Michael Niedermayer <[email protected]> AuthorDate: Sat Jul 11 21:21:57 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:29 2026 +0200 avformat/codec2: avoid integer overflow in packet size and duration Fixes: signed integer overflow Fixes: 2jy_poc_codec2.zip / poc_codec2.raw Fixes: jOQASNnOm6O7 Found-by: Jiale Yao <[email protected]> (cherry picked from commit 2b7e5012424a52998cd6a1fe3556272313cb7527) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/codec2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavformat/codec2.c b/libavformat/codec2.c index dcc3ed9e59..0791b61b35 100644 --- a/libavformat/codec2.c +++ b/libavformat/codec2.c @@ -198,6 +198,8 @@ static int codec2_read_packet(AVFormatContext *s, AVPacket *pkt) } //try to read desired number of frames, compute n from to actual number of bytes read + if (c2->frames_per_packet > INT_MAX / block_align) + return AVERROR(EINVAL); size = c2->frames_per_packet * block_align; ret = av_get_packet(s->pb, pkt, size); if (ret < 0) { @@ -207,7 +209,7 @@ static int codec2_read_packet(AVFormatContext *s, AVPacket *pkt) //only set duration - compute_pkt_fields() and ff_pcm_read_seek() takes care of everything else //tested by spamming the seek functionality in ffplay n = ret / block_align; - pkt->duration = n * frame_size; + pkt->duration = (int64_t)n * frame_size; return ret; } _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
