PR #23643 opened by aolinf URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23643 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23643.patch When parsing the option -F, the value parsed by strtod can be extremely large. Scaling it by AV_TIME_BASE / 1000 can cause it to exceed the range of a 64-bit integer. Casting this double value to int64_t triggers undefined behavior and a UBSan runtime error like: "runtime error: 9e+26 is outside the range of representable values of type 'long'" Fix this by ensuring the parsed double value does not exceed the scaled equivalent of INT64_MAX. Signed-off-by: Aolin Feng <aolinf@google.com> # Summary of changes Briefly describe what this PR does and why. <!-- If this PR requires new FATE test samples, attach them to the PR and list their target paths below (relative to the fate-suite root). Attached filenames must match the sample's filename: ```fate-samples # e.g. vorbis/new-sample.ogg ``` --> From 874bf8316e4cc0fb7fcfa655a1ce66197662362d Mon Sep 17 00:00:00 2001 From: Aolin Feng <aolinf@google.com> Date: Mon, 29 Jun 2026 17:19:32 +0000 Subject: [PATCH] libavformat/sbgdec: fix overflow check when parsing option -F When parsing the option -F, the value parsed by strtod can be extremely large. Scaling it by AV_TIME_BASE / 1000 can cause it to exceed the range of a 64-bit integer. Casting this double value to int64_t triggers undefined behavior and a UBSan runtime error like: "runtime error: 9e+26 is outside the range of representable values of type 'long'" Fix this by ensuring the parsed double value does not exceed the scaled equivalent of INT64_MAX. Signed-off-by: Aolin Feng <aolinf@google.com> --- libavformat/sbgdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c index 71cbad2dae..ffdc2abe8d 100644 --- a/libavformat/sbgdec.c +++ b/libavformat/sbgdec.c @@ -379,7 +379,7 @@ static int parse_options(struct sbg_parser *p) case 'F': FORWARD_ERROR(parse_optarg(p, opt, &oarg)); v = strtod(oarg.s, &tptr); - if (oarg.e != tptr) { + if (oarg.e != tptr || v > (double)INT64_MAX / AV_TIME_BASE * 1000) { snprintf(p->err_msg, sizeof(p->err_msg), "syntax error for option -F"); return AVERROR_INVALIDDATA; -- 2.52.0