max/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avfilter/f_ebur128: avoid signed-int wrap when sizing per-channel cache

Browse Source 
Fixes: integer overflow
Fixes: out of array access

Found-by: Claude (Anthropic), reported by Omkhar Arasaratnam <omkhar@linkedin.com>.
This commit is contained in:
Michael Niedermayer
2026-05-21 22:42:45 +02:00
committed by michaelni
parent e1be70dcac
commit 537e87e3c2
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavfilter/f_ebur128.c
+10 -3
View File
@@ -445,15 +445,22 @@ static int config_audio_output(AVFilterLink *outlink)
if (!ebur128->ch_weighting || !ebur128->dsp.y || !ebur128->dsp.z)
return AVERROR(ENOMEM);
#define I400_BINS(x) ((x) * 4 / 10)
#define I400_BINS(x) ((x) * 2 / 5)
#define I3000_BINS(x) ((x) * 3)
if (outlink->sample_rate > INT_MAX/3U || outlink->sample_rate < 3)
return AVERROR(EINVAL);
ebur128->i400.cache_size = I400_BINS(outlink->sample_rate);
ebur128->i3000.cache_size = I3000_BINS(outlink->sample_rate);
size_t i400_count, i3000_count;
if (av_size_mult(nb_channels, ebur128->i400.cache_size, &i400_count) < 0 || i400_count > INT_MAX ||
av_size_mult(nb_channels, ebur128->i3000.cache_size, &i3000_count) < 0 || i3000_count > INT_MAX)
return AVERROR(EINVAL);
ebur128->i400.sum = av_calloc(nb_channels, sizeof(*ebur128->i400.sum));
ebur128->i3000.sum = av_calloc(nb_channels, sizeof(*ebur128->i3000.sum));
ebur128->i400.cache = av_calloc(nb_channels * ebur128->i400.cache_size, sizeof(*ebur128->i400.cache));
ebur128->i3000.cache = av_calloc(nb_channels * ebur128->i3000.cache_size, sizeof(*ebur128->i3000.cache));
ebur128->i400.cache = av_calloc(i400_count, sizeof(*ebur128->i400.cache));
ebur128->i3000.cache = av_calloc(i3000_count, sizeof(*ebur128->i3000.cache));
if (!ebur128->i400.sum || !ebur128->i3000.sum ||
!ebur128->i400.cache || !ebur128->i3000.cache)
return AVERROR(ENOMEM);