Commit ed85a019cf for ffmpeg

commit ed85a019cfa1e8ef6858f4824128b4fb95068948
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sat Oct 10 06:45:00 2026 +0200

    avformat/sbgdec: compute the extradata size of the intervals in 64 bits

    Signed integer overflow Replicated through UnModified FFmpeg with UBSAN, only with -max_alloc raised above its default

    Found during triage/review of OSS-Fuzz issue 474457174

    Fixes: tETfcRw9ov1Y/a.sbg / gen_a.py
    Fixes: tETfcRw9ov1Y

    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavformat/sbgdec.c b/libavformat/sbgdec.c
index 0792520723..fb5593511b 100644
--- a/libavformat/sbgdec.c
+++ b/libavformat/sbgdec.c
@@ -1347,15 +1347,15 @@ static int generate_intervals(void *log, struct sbg_script *s, int sample_rate,
 static int encode_intervals(struct sbg_script *s, AVCodecParameters *par,
                             struct ws_intervals *inter)
 {
-    int i, edata_size = 4, ret;
+    int i, ret;
+    int64_t edata_size = 4;
     uint8_t *edata;

-    for (i = 0; i < inter->nb_inter; i++) {
+    for (i = 0; i < inter->nb_inter; i++)
         edata_size += inter->inter[i].type == WS_SINE  ? 44 :
                       inter->inter[i].type == WS_NOISE ? 32 : 0;
-        if (edata_size < 0)
-            return AVERROR(ENOMEM);
-    }
+    if (edata_size > INT_MAX)
+        return AVERROR(ENOMEM);
     if ((ret = ff_alloc_extradata(par, edata_size)) < 0)
         return ret;
     edata = par->extradata;