[PR] avformat/mp3enc: fix underflow of the LAME encoder delay (PR #23990)

PR #23990 opened by Romain Beauxis (toots)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23990
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23990.patch

AV_RL32() is unsigned, so a skip_samples value below 528 + 1 wraps around
instead of clamping to zero and is written out as a delay of 4095 samples.


>From 7a56eb9d83bb84010688657abd8db47ab70fec32 Mon Sep 17 00:00:00 2001
From: Romain Beauxis <[email protected]>
Date: Sun, 2 Aug 2026 11:46:06 -0500
Subject: [PATCH] avformat/mp3enc: fix underflow of the LAME encoder delay

AV_RL32() is unsigned, so a skip_samples value below 528 + 1 wraps around
instead of clamping to zero and is written out as a delay of 4095 samples.
---
 libavformat/mp3enc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavformat/mp3enc.c b/libavformat/mp3enc.c
index 87c13f92bd..131fb231fc 100644
--- a/libavformat/mp3enc.c
+++ b/libavformat/mp3enc.c
@@ -367,9 +367,9 @@ static int mp3_write_audio_packet(AVFormatContext *s, AVPacket *pkt)
                                                 AV_PKT_DATA_SKIP_SAMPLES,
                                                 &side_data_size);
             if (side_data && side_data_size >= 10) {
-                mp3->padding = FFMAX(AV_RL32(side_data + 4) + 528 + 1, 0);
+                mp3->padding = FFMAX((int64_t)AV_RL32(side_data + 4) + 528 + 1, 0);
                 if (!mp3->delay)
-                    mp3->delay =  FFMAX(AV_RL32(side_data) - 528 - 1, 0);
+                    mp3->delay =  FFMAX((int64_t)AV_RL32(side_data) - 528 - 1, 0);
             } else {
                 mp3->padding = 0;
             }
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]