[FFmpeg-devel] [PATCH] Numeric truncation in svs.c:57

[Andreas Rheinhardt]

mezhuevtp at ispras.ru:
> From: headshog <craaaaaachind at gmail.com>
> 
> Hi! We've been fuzzing `ffmpeg` with [sydr-fuzz](https://github.com/ispras/oss-sydr-fuzz) security predicates and we found numeric truncation error in `svs.c:57`.
> In function `svs_read_header` on line 57 field `st->codecpar->sample_rate` has type `int`, the type of return value in `av_rescale_rnd` function is `int64_t`, so the numeric truncation may occur here.
> Then value of `st->codecpar->sample_rate` is passed to `avpriv_set_pts_info` function parameter `unsgined int pts_den`.
> In a way not to break API/ABI, I've added a checker for valid `sample_rate` value.
> ---
>  libavformat/svs.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/libavformat/svs.c b/libavformat/svs.c
> index b91d29f5a6..54f24f539c 100644
> --- a/libavformat/svs.c
> +++ b/libavformat/svs.c
> @@ -42,6 +42,11 @@ static int svs_read_header(AVFormatContext *s)
>  {
>      AVStream *st;
>      uint32_t pitch;
> +    int64_t rescale_val;
> +
> +    rescale_val = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);

Using an uninitialized variable is supposed to fix something?

> +    if (rescale_val > INT_MAX)
> +        return AVERROR(ERANGE);
>  
>      st = avformat_new_stream(s, NULL);
>      if (!st)
> @@ -54,7 +59,7 @@ static int svs_read_header(AVFormatContext *s)
>      st->codecpar->codec_type     = AVMEDIA_TYPE_AUDIO;
>      st->codecpar->codec_id       = AV_CODEC_ID_ADPCM_PSX;
>      st->codecpar->ch_layout      = (AVChannelLayout)AV_CHANNEL_LAYOUT_STEREO;
> -    st->codecpar->sample_rate    = av_rescale_rnd(pitch, 48000, 4096, AV_ROUND_INF);
> +    st->codecpar->sample_rate    = rescale_val;
>      st->codecpar->block_align    = 32;
>      st->start_time               = 0;
>      if (s->pb->seekable & AVIO_SEEKABLE_NORMAL)