Opened 18 months ago

Last modified 18 months ago

#11471 new defect

Integer wrap-around in oggparsevorbis.c vorbis_packet() final packet handling creating frames with very long duration

Reported by: Jøger Hansegård Owned by:
Priority: normal Component: avformat
Version: 7.0 Keywords:
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description (last modified by Jøger Hansegård)

Summary of the bug:
With attached file, unsigned integer wrap-around in oggparsevorbis.c/vorbis_packet() during the calculation of priv->final_duration/os->pduration creates packets with very long durations (4294967232us). The os->end_trimming also becomes invalid, which prevents the discard_samples() function from discarding the padding. Here discard_padding becomes greater than the number of samples in the frame, allowing the AVFrame with a long duration to pass through.

See also https://bugreports.qt.io/browse/QTBUG-126592

How to reproduce:

% ffprobe -show_frames -show_packets corrupt_end.ogg
ffprobe version 7.0.2-full_build-www.gyan.dev Copyright (c) 2007-2024 the FFmpeg developers
  built with gcc 13.2.0 (Rev5, Built by MSYS2 project)

Attachments (1)

corrupt_end.ogg (5.8 KB ) - added by Jøger Hansegård 18 months ago.
Ogg/Vorbis file used to reproduce ticket #11471

Download all attachments as: .zip

Change History (2)

by Jøger Hansegård, 18 months ago

Attachment: corrupt_end.ogg added

Ogg/Vorbis file used to reproduce ticket #11471

comment:1 by Jøger Hansegård, 18 months ago

Description: modified (diff)
Note: See TracTickets for help on using tickets.