This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 2f4decb2dc avcodec/cngdec: fix float-to-int overflow in
cng_decode_frame()
2f4decb2dc is described below
commit 2f4decb2dc284e9988f3bde45acbaecc91b73599
Author: Yong Yu <[email protected]>
AuthorDate: Sun Jun 14 03:57:01 2026 +0000
Commit: Marvin Scholz <[email protected]>
CommitDate: Thu Sep 24 20:06:23 2026 +0000
avcodec/cngdec: fix float-to-int overflow in cng_decode_frame()
The issue is caused by floating-point to integer overflow conversion
at function av_clip_int16(p->filter_out[i + p->order]).
The float value is out of bounds, which leads to undefined behavior
(causing positive peaks to invert to the negative rail on standard x86
builds)
and a crash when compiled with -fsanitize=float-cast-overflow.
- Handle NAN using isfinite()
- Clip float value into valid range of int16 with av_clipf
- Register the fate-comfortnoise test in FATE_VOICE.
- Use the 'astats' filter to verify the output RMS level (expecting < -3dB).
This allows detecting the regression on standard x86 builds (where the bug
causes positive peaks to invert to the negative rail, leading to RMS near
0dB)
while avoiding flakiness from cross-platform float divergence on
intermediate samples.
How to reproduce the sanitizer crash:
Revert the fix in libavcodec/cngdec.c, configure and run:
./configure --extra-cflags='-fsanitize=float-cast-overflow
-fno-sanitize-recover=float-cast-overflow'
--extra-ldflags='-fsanitize=float-cast-overflow'
make fate-comfortnoise
How to reproduce the FATE test failure on standard x86 builds:
1. Revert the fix in libavcodec/cngdec.c (change back to av_clip_int16)
2. ./configure
3. make fate-comfortnoise
Change-Id: I7521e1025823843b579a4bc2194b00e37bf6b7b3
---
libavcodec/cngdec.c | 6 ++++--
tests/fate/voice.mak | 19 +++++++++++++++++++
2 files changed, 23 insertions(+), 2 deletions(-)
diff --git a/libavcodec/cngdec.c b/libavcodec/cngdec.c
index eb37c33eb4..9e7905ee6d 100644
--- a/libavcodec/cngdec.c
+++ b/libavcodec/cngdec.c
@@ -153,8 +153,10 @@ static int cng_decode_frame(AVCodecContext *avctx, AVFrame
*frame,
if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
return ret;
buf_out = (int16_t *)frame->data[0];
- for (i = 0; i < avctx->frame_size; i++)
- buf_out[i] = av_clip_int16(p->filter_out[i + p->order]);
+ for (i = 0; i < avctx->frame_size; i++) {
+ const float f = p->filter_out[i + p->order];
+ buf_out[i] = !isfinite(f) ? 0 : av_clipf(f, INT16_MIN, INT16_MAX);
+ }
memcpy(p->filter_out, p->filter_out + avctx->frame_size,
p->order * sizeof(*p->filter_out));
diff --git a/tests/fate/voice.mak b/tests/fate/voice.mak
index 70855788d2..6def61689c 100644
--- a/tests/fate/voice.mak
+++ b/tests/fate/voice.mak
@@ -94,5 +94,24 @@ fate-truespeech: CMD = pcm -i
$(TARGET_SAMPLES)/truespeech/a6.wav
fate-truespeech: CMP = oneoff
fate-truespeech: REF = $(SAMPLES)/truespeech/a6.pcm
+# This test reproduces a float-cast-overflow in the comfortnoise decoder
+# (cngdec.c) when fed with a 24-byte all-zero G.723.1 frame.
+# The bug causes positive float values to overflow to negative integer values
+# during clipping, resulting in massive negative bias (RMS near 0dB).
+# The fixed version clips correctly, resulting in quieter output (RMS < -3dB).
+tests/data/g723_1-comfortnoise-overflow.bin: TAG = GEN
+tests/data/g723_1-comfortnoise-overflow.bin: ffmpeg$(PROGSSUF)$(EXESUF) |
tests/data
+ $(M)$(TARGET_EXEC) $(TARGET_PATH)/$< -nostdin \
+ -lavfi nullsrc=s=4x4,format=yuv420p,geq=lum=0:cb=0:cr=0 \
+ -vframes 1 -f rawvideo -y $(TARGET_PATH)/$@ 2>/dev/null
+
+FATE_VOICE-$(call FILTERDEMDECENCMUX, ASTATS NULLSRC FORMAT GEQ, G723_1, \
+ COMFORTNOISE WRAPPED_AVFRAME, PCM_S16LE
RAWVIDEO, \
+ NULL RAWVIDEO, LAVFI_INDEV) +=
fate-comfortnoise
+fate-comfortnoise: tests/data/g723_1-comfortnoise-overflow.bin
+fate-comfortnoise: CMP = grep
+fate-comfortnoise: REF = RMS level dB: \(-[3-9]\|-[1-9][0-9]\)
+fate-comfortnoise: CMD = ffmpeg -f g723_1 -codec:a comfortnoise -i
$(TARGET_PATH)/tests/data/g723_1-comfortnoise-overflow.bin -af astats -c:a
pcm_s16le -f null -
+
FATE_SAMPLES_FFMPEG += $(FATE_VOICE-yes)
fate-voice: $(FATE_VOICE-yes)
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
