[PR] libavformat/sbgdec: fix overflow check when parsing option -F (PR #23643)

PR #23643 opened by aolinf
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23643
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23643.patch

When parsing the option -F, the value parsed by strtod can be extremely large. Scaling it by AV_TIME_BASE / 1000 can cause it to exceed the range of a 64-bit integer. Casting this double value to int64_t triggers undefined behavior and a
UBSan runtime error like:

"runtime error: 9e+26 is outside the range of representable values of type 'long'"

Fix this by ensuring the parsed double value does not exceed the scaled equivalent of INT64_MAX.

Signed-off-by: Aolin Feng <[email protected]>

# Summary of changes

Briefly describe what this PR does and why.

<!--
If this PR requires new FATE test samples, attach them to the PR and
list their target paths below (relative to the fate-suite root).

Attached filenames must match the sample's filename:

```fate-samples
# e.g. vorbis/new-sample.ogg
```
-->



>From 874bf8316e4cc0fb7fcfa655a1ce66197662362d Mon Sep 17 00:00:00 2001
From: Aolin Feng <[email protected]>
Date: Mon, 29 Jun 2026 17:19:32 +0000
Subject: [PATCH] libavformat/sbgdec: fix overflow check when parsing option -F

When parsing the option -F, the value parsed by strtod can be extremely large. Scaling it by AV_TIME_BASE / 1000 can cause it to exceed the range of a 64-bit integer. Casting this double value to int64_t triggers undefined behavior and a
UBSan runtime error like:

"runtime error: 9e+26 is outside the range of representable values of type 'long'"

Fix this by ensuring the parsed double value does not exceed the
scaled equivalent of INT64_MAX.

Signed-off-by: Aolin Feng <[email protected]>
---
 libavformat/sbgdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c
index 71cbad2dae..ffdc2abe8d 100644
--- a/libavformat/sbgdec.c
+++ b/libavformat/sbgdec.c
@@ -379,7 +379,7 @@ static int parse_options(struct sbg_parser *p)
                 case 'F':
                     FORWARD_ERROR(parse_optarg(p, opt, &oarg));
                     v = strtod(oarg.s, &tptr);
-                    if (oarg.e != tptr) {
+                    if (oarg.e != tptr || v > (double)INT64_MAX / AV_TIME_BASE * 1000) {
                         snprintf(p->err_msg, sizeof(p->err_msg),
                                  "syntax error for option -F");
                         return AVERROR_INVALIDDATA;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]