[PR] avformat/codec2: avoid integer overflow in packet size and duration (PR #23914)

PR #23914 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23914
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23914.patch

Fixes: signed integer overflow
Fixes: 2jy_poc_codec2.zip / poc_codec2.raw
Fixes: jOQASNnOm6O7
Found-by: Jiale Yao <[email protected]>



>From 94e977e624dd8282a25aad90fc85fe717cc9903d Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Sat, 11 Jul 2026 21:21:57 +0200
Subject: [PATCH] avformat/codec2: avoid integer overflow in packet size and
 duration

Fixes: signed integer overflow
Fixes: 2jy_poc_codec2.zip / poc_codec2.raw
Fixes: jOQASNnOm6O7
Found-by: Jiale Yao <[email protected]>
---
 libavformat/codec2.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/codec2.c b/libavformat/codec2.c
index dcc3ed9e59..0791b61b35 100644
--- a/libavformat/codec2.c
+++ b/libavformat/codec2.c
@@ -198,6 +198,8 @@ static int codec2_read_packet(AVFormatContext *s, AVPacket *pkt)
     }
 
     //try to read desired number of frames, compute n from to actual number of bytes read
+    if (c2->frames_per_packet > INT_MAX / block_align)
+        return AVERROR(EINVAL);
     size = c2->frames_per_packet * block_align;
     ret = av_get_packet(s->pb, pkt, size);
     if (ret < 0) {
@@ -207,7 +209,7 @@ static int codec2_read_packet(AVFormatContext *s, AVPacket *pkt)
     //only set duration - compute_pkt_fields() and ff_pcm_read_seek() takes care of everything else
     //tested by spamming the seek functionality in ffplay
     n = ret / block_align;
-    pkt->duration = n * frame_size;
+    pkt->duration = (int64_t)n * frame_size;
 
     return ret;
 }
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]