Builder ffmpegsos-solaris10-sparc Build #13555

Results:

Failed shell_2 shell_3 shell_4 shell_5

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpegsos-solaris10-sparc' triggered this build

Steps and Logfiles:

1. git update ( 8 secs )
   1. stdio
2. shell 'gsed -i ...' ( 0 secs )
   1. stdio
3. shell_1 'gsed -i ...' ( 0 secs )
   1. stdio
4. shell_2 'gsed -i ...' failed ( 0 secs )
   1. stdio
5. shell_3 './configure --samples="../../../ffmpeg/fate-suite" ...' failed ( 8 secs )
   1. stdio
   2. config.log
6. shell_4 'gmake fate-rsync' failed ( 0 secs )
   1. stdio
7. shell_5 '../../../ffmpeg/fate.sh ../../../ffmpeg/fate_config_sos.sh' failed ( 0 secs )
   1. stdio
   2. configure.log
   3. compile.log
   4. test.log

Build Properties:

Forced Build Properties:

Responsible Users:

1. David Korczynski

   davidohnoyoudont@adalogics.com

Timing:

All Changes:

:

1. Change #269678

   Category	ffmpeg
   Changed by	David Korczynski <davidohnoyoudont@adalogics.com>
   Changed at	Sat 06 Jun 2026 23:32:08
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	1e9984772b6ef878d3ae4a58e01d6a6d63a61bd7

   Comments

   avcodec/fastaudio: reject subframes count whose * 256 product overflows 32-bit
   fastaudio_decode() computes
       subframes = pkt->size / (40 * channels);
       frame->nb_samples = subframes * 256;
   both as 32-bit signed multiplications. When pkt->size is large enough
   to make subframes >= 2^24, the second multiplication overflows the
   signed int range and frame->nb_samples wraps to a small value.
   ff_get_buffer() then sizes the audio plane for that wrapped sample
   count, while the decoder loop at line 152 still iterates the full
   (unwrapped) subframes count, performing a 1024-byte memcpy per
   subframe per channel. The 27th iteration (or first iteration with
   nb_samples=0) writes one byte past the per-plane allocation,
   yielding the ASan heap-buffer-overflow WRITE at libavcodec/fastaudio
   .c:171 reported as ANT-2026-03891.
   
   Reject the subframes value whose *256 product would overflow before
   performing the multiplication. The bound INT_MAX / 256 (= 8388607)
   keeps the existing two's-complement semantics of every reachable
   input and rejects only the configurations that would have wrapped.
   
   Reproducer: a crafted AVI declaring one mono audio chunk of
   671_088_680 bytes (sparse) with the decoder forced via
   'ffmpeg -c:a fastaudio -i evil.avi'.
   
   Found-by: Anthropic agents; validated and reported by Ada Logics.
   
   Signed-off-by: David Korczynski <david@adalogics.com>
   Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

   Changed files

   • libavcodec/fastaudio.c