Opened 18 months ago
Last modified 18 months ago
#11471 new defect
Integer wrap-around in oggparsevorbis.c vorbis_packet() final packet handling creating frames with very long duration
| Reported by: | Jøger Hansegård | Owned by: | |
|---|---|---|---|
| Priority: | normal | Component: | avformat |
| Version: | 7.0 | Keywords: | |
| Cc: | Blocked By: | ||
| Blocking: | Reproduced by developer: | no | |
| Analyzed by developer: | no |
Description (last modified by )
Summary of the bug:
With attached file, unsigned integer wrap-around in oggparsevorbis.c/vorbis_packet() during the calculation of priv->final_duration/os->pduration creates packets with very long durations (4294967232us). The os->end_trimming also becomes invalid, which prevents the discard_samples() function from discarding the padding. Here discard_padding becomes greater than the number of samples in the frame, allowing the AVFrame with a long duration to pass through.
See also https://bugreports.qt.io/browse/QTBUG-126592
How to reproduce:
% ffprobe -show_frames -show_packets corrupt_end.ogg ffprobe version 7.0.2-full_build-www.gyan.dev Copyright (c) 2007-2024 the FFmpeg developers built with gcc 13.2.0 (Rev5, Built by MSYS2 project)
Attachments (1)
Change History (2)
by , 18 months ago
| Attachment: | corrupt_end.ogg added |
|---|
comment:1 by , 18 months ago
| Description: | modified (diff) |
|---|
Note:
See TracTickets
for help on using tickets.



Ogg/Vorbis file used to reproduce ticket #11471