PR #23345 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23345 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23345.patch
Fixes: signed integer overflow: 314572800 * 8 cannot be represented in type 'int' Tighten the guard to INT_MAX/14, which covers the largest expansion factor used in the function currently. Found-by: Jiale Yao <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> >From cd52239b2b420a9d3b588704f5ac8f9ccb3d375c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 4 Jun 2026 21:42:47 +0200 Subject: [PATCH] avcodec/adpcm: fix signed integer overflow in get_nb_samples() Fixes: signed integer overflow: 314572800 * 8 cannot be represented in type 'int' Tighten the guard to INT_MAX/14, which covers the largest expansion factor used in the function currently. Found-by: Jiale Yao <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/adpcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index 6ff3dad613..74af2cb4d3 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -1174,7 +1174,7 @@ static int get_nb_samples(AVCodecContext *avctx, GetByteContext *gb, if(ch <= 0) return 0; - if (buf_size > INT_MAX / 2) + if (buf_size > INT_MAX / 14) return 0; switch (avctx->codec->id) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
