From e94580c3699ba33c48eb13ee8b07a5fed9b9665e Mon Sep 17 00:00:00 2001
From: itsmattkc <34096995+itsmattkc@users.noreply.github.com>
Date: Sat, 29 Oct 2022 12:07:55 -0700
Subject: [PATCH] ffmpegencoder: split sample buffer when writing audio

Avoids integer overflow in FFmpeg

Fixes #2072
---
 app/codec/ffmpeg/ffmpegencoder.cpp | 32 ++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/app/codec/ffmpeg/ffmpegencoder.cpp b/app/codec/ffmpeg/ffmpegencoder.cpp
index a0f08ede6..403bfab71 100644
--- a/app/codec/ffmpeg/ffmpegencoder.cpp
+++ b/app/codec/ffmpeg/ffmpegencoder.cpp
@@ -280,13 +280,20 @@ bool FFmpegEncoder::WriteFrame(FramePtr frame, rational time)
 
 bool FFmpegEncoder::WriteAudio(const SampleBuffer &audio)
 {
+  if (!audio.is_allocated()) {
+    return true;
+  }
+
   bool result = true;
 
-  // Create input buffer
-  int input_sample_count = 0;
-  uint8_t** input_data = nullptr;
-  if (audio.is_allocated()) {
-    input_sample_count = audio.sample_count();
+  size_t start = 0;
+  size_t end = audio.sample_count();
+  const size_t max_frame = 48000;
+
+  while (start < end) {
+    // Create input buffer
+    uint8_t** input_data = nullptr;
+    size_t input_sample_count = std::min(end - start, max_frame);
     int input_linesize;
 
     int r = av_samples_alloc_array_and_samples(&input_data, &input_linesize, audio.audio_params().channel_count(),
@@ -296,17 +303,20 @@ bool FFmpegEncoder::WriteAudio(const SampleBuffer &audio)
       FFmpegError(tr("Failed to allocate sample array"), r);
       return false;
     } else {
+      int bpsc = audio.audio_params().bytes_per_sample_per_channel();
       for (int i=0; i<audio.audio_params().channel_count(); i++) {
-        memcpy(input_data[i], audio.data(i), input_sample_count * audio.audio_params().bytes_per_sample_per_channel());
+        memcpy(input_data[i], audio.data(i) + start, input_sample_count * bpsc);
       }
+
+      start += input_sample_count;
     }
-  }
 
-  result = WriteAudioData(audio.audio_params().is_valid() ? audio.audio_params() : params().audio_params(), const_cast<const uint8_t**>(input_data), input_sample_count);
+    result = WriteAudioData(audio.audio_params().is_valid() ? audio.audio_params() : params().audio_params(), const_cast<const uint8_t**>(input_data), input_sample_count);
 
-  if (input_data) {
-    av_freep(&input_data[0]);
-    av_freep(&input_data);
+    if (input_data) {
+      av_freep(&input_data[0]);
+      av_freep(&input_data);
+    }
   }
 
   return result;