Commit 39acec9d82 for ffmpeg

commit 39acec9d82cc6b104b0f7d68368ed2fb2920596c
Author: Zhao Zhili <quinkblack@foxmail.com>
Date:   Wed Oct 14 13:13:09 2026 +0800

    avformat/iamf_parse: reject codec configs with an invalid sample rate

    AAC, FLAC and IAMF PCM codec configs take their sample rate from the
    bitstream. Zero is not a usable rate, and an IAMF PCM rate above
    INT_MAX turns negative in the int field.

    The rate is an operand of av_rescale(). A negative value as the
    multiplier in param_parse() hits av_assert2(b >= 0), and a zero value as
    the divisor in mix_presentation_obu() hits av_assert2(c > 0).

    Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>

diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 892145cd87..b95c47ce8e 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -110,6 +110,8 @@ static int aac_decoder_config(IAMFCodecConfig *codec_config,
         return ret;

     codec_config->sample_rate = cfg.sample_rate;
+    if (codec_config->sample_rate <= 0)
+        return AVERROR_INVALIDDATA;

     return 0;
 }
@@ -138,6 +140,8 @@ static int flac_decoder_config(IAMFCodecConfig *codec_config,

     codec_config->extradata_size = left;
     codec_config->sample_rate = AV_RB24(codec_config->extradata + 10) >> 4;
+    if (codec_config->sample_rate <= 0)
+        return AVERROR_INVALIDDATA;

     return 0;
 }
@@ -154,8 +158,11 @@ static int ipcm_decoder_config(IAMFCodecConfig *codec_config,
     if (sample_format > 1 || sample_size > 2U || codec_config->audio_roll_distance)
         return AVERROR_INVALIDDATA;

-    codec_config->codec_id = sample_fmt[sample_format][sample_size];
     codec_config->sample_rate = avio_rb32(pb);
+    if (codec_config->sample_rate <= 0)
+        return AVERROR_INVALIDDATA;
+
+    codec_config->codec_id = sample_fmt[sample_format][sample_size];

     if (len - avio_tell(pb))
         return AVERROR_INVALIDDATA;