Change #286108

Comments

avformat/mov: Check sample_rate in stsd version 2 audio
The QuickTime SoundDescription version 2 layout stores the sample rate as
a 64 bit float. Converting it to int is undefined behaviour when the value
does not fit into int, NaN included -- and NaN slips through every
integer-style range check because all comparisons against it are false.

The sample_rate < 0 check in ff_mov_read_stsd_entries() runs after the
conversion has already happened, so it cannot prevent this.

Validate the double before converting it, matching soxdec.

Zero is deliberately still accepted: mov_finalize_stsd_codec() substitutes
sc->time_scale for a zero audio sample rate, and rejecting zero here would
remove that existing recovery without being needed for the conversion fix.
Negative, NaN, infinite and out-of-range values are rejected before the
conversion.

Fixes: mov.c:3031 runtime error: nan is outside the range of
       representable values of type 'int'

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Furkan Efe Can <caglarf646@gmail.com>

Changed files

• libavformat/mov.c