Traneptora/FFmpeg
1
Fork 0
forked from FFmpeg/FFmpeg
Code Pull requests Activity

avcodec/ratecontrol: Handle wanted bits overflow

Browse source 
Fixes: 5.92611e+20 is outside the range of representable values of type 'unsigned long'
Fixes: 68984/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SNOW_fuzzer-5155755073273856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-06-17 19:26:08 +02:00
parent af99358353
commit 7147c3c911
No known key found for this signature in database
GPG key ID: B18E8928B3948D64
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
libavcodec/ratecontrol.c
View file

@ -936,6 +936,7 @@ float ff_rate_estimate_qscale(MpegEncContext *s, int dry_run)
wanted_bits = rce->expected_bits; wanted_bits = rce->expected_bits;
} else { } else {
const MPVPicture *dts_pic; const MPVPicture *dts_pic;
double wanted_bits_double;
rce = &local_rce; rce = &local_rce;
/* FIXME add a dts field to AVFrame and ensure it is set and use it /* FIXME add a dts field to AVFrame and ensure it is set and use it
@ -947,9 +948,14 @@ float ff_rate_estimate_qscale(MpegEncContext *s, int dry_run)
dts_pic = s->last_pic.ptr; dts_pic = s->last_pic.ptr;
if (!dts_pic || dts_pic->f->pts == AV_NOPTS_VALUE) if (!dts_pic || dts_pic->f->pts == AV_NOPTS_VALUE)
wanted_bits = (uint64_t)(s->bit_rate * (double)picture_number / fps); wanted_bits_double = s->bit_rate * (double)picture_number / fps;
else else
wanted_bits = (uint64_t)(s->bit_rate * (double)dts_pic->f->pts / fps); wanted_bits_double = s->bit_rate * (double)dts_pic->f->pts / fps;
if (wanted_bits_double > INT64_MAX) {
av_log(s, AV_LOG_WARNING, "Bits exceed 64bit range\n");
wanted_bits = INT64_MAX;
} else
wanted_bits = (int64_t)wanted_bits_double;
} }
diff = s->total_bits - wanted_bits; diff = s->total_bits - wanted_bits;