Opened 8 years ago

Closed 8 years ago

Last modified 8 years ago

#5127 closed defect (fixed)

left shift of negative value in mc_chroma_unscaled()

Reported by: tsmith Owned by:
Priority: normal Component: avcodec
Version: git-master Keywords: vp9
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:
UBSan: libavcodec/vp9.c:2758:20: runtime error: left shift of negative value -8
How to reproduce:

% ffmpeg -f ivf -i <test_case> -f null -
ffmpeg version N-77718-g72673ad Copyright (c) 2000-2016 the FFmpeg developers
  built with Ubuntu clang version 3.7.1-svn253742-1~exp1 (branches/release_37) (based on LLVM 3.7.1)
  configuration: --cc=clang --cxx=clang++ --disable-libxcb --disable-xlib --disable-logging --disable-ffprobe --disable-ffplay --disable-sdl --disable-ffserver --disable-doc --disable-pthreads --disable-network --disable-d3d11va --disable-dxva2 --disable-vaapi --disable-vda --disable-vdpau --disable-stripping --disable-runtime-cpudetect --disable-securetransport --disable-iconv
  libavutil      55. 12.100 / 55. 12.100
  libavcodec     57. 22.100 / 57. 22.100
  libavformat    57. 21.101 / 57. 21.101
  libavdevice    57.  0.100 / 57.  0.100
  libavfilter     6. 23.100 /  6. 23.100
  libswscale      4.  0.100 /  4.  0.100
  libswresample   2.  0.101 /  2.  0.101
[NULL @ 0x619000005a80] [IMGUTILS @ 0x7f9c7c09b1a0] Picture size 26214x26214 is invalid
[ivf @ 0x61b00001f180] Failed to open codec in av_find_stream_info
[vp9 @ 0x619000005a80] Warning: not compiled with thread support, using thread emulation
Input #0, ivf, from '/home/user/Desktop/vpx/corpus/128c0e3038af2af236f47c471da407a36c0c4887':
  Duration: N/A, start: 0.000000, bitrate: N/A
    Stream #0:0: Video: vp9 (Profile 0) (VP90 / 0x30395056), yuv420p(tv), 64x36, 6710886.00 tbr, 6710886.00 tbn, 6710886.00 tbc
[wrapped_avframe @ 0x619000000a80] Warning: not compiled with thread support, using thread emulation
[vp9 @ 0x619000001480] Warning: not compiled with thread support, using thread emulation
Output #0, null, to 'pipe:':
  Metadata:
    encoder         : Lavf57.21.101
    Stream #0:0: Video: wrapped_avframe, yuv420p, 64x36, q=2-31, 200 kb/s, 6710886.00 fps, 6710886.00 tbn, 6710886.00 tbc
    Metadata:
      encoder         : Lavc57.22.100 wrapped_avframe
Stream mapping:
  Stream #0:0 -> #0:0 (vp9 (native) -> wrapped_avframe (native))
Press [q] to stop, [?] for help
libavcodec/vp9.c:2758:20: runtime error: left shift of negative value -8
    #0 0x1e0d384 in mc_chroma_unscaled /home/user/code/ffmpeg/libavcodec/vp9.c:2758:44
    #1 0x1e0d384 in inter_pred_8bpp /home/user/code/ffmpeg/libavcodec/vp9_mc_template.c:190
    #2 0x1ca28a7 in inter_recon /home/user/code/ffmpeg/libavcodec/vp9.c:2986:13
    #3 0x1ca28a7 in inter_recon_8bpp /home/user/code/ffmpeg/libavcodec/vp9.c:3040
    #4 0x1ca28a7 in decode_b /home/user/code/ffmpeg/libavcodec/vp9.c:3294
    #5 0x1c8fbbd in decode_sb /home/user/code/ffmpeg/libavcodec/vp9.c:3386:9
    #6 0x1c90880 in decode_sb /home/user/code/ffmpeg/libavcodec/vp9.c:3414:17
    #7 0x1c906d3 in decode_sb /home/user/code/ffmpeg/libavcodec/vp9.c:3407:17
    #8 0x1c906d3 in decode_sb /home/user/code/ffmpeg/libavcodec/vp9.c:3407:17
    #9 0x1c75f55 in vp9_decode_frame /home/user/code/ffmpeg/libavcodec/vp9.c:4164:29
    #10 0x1a3fc96 in avcodec_decode_video2 /home/user/code/ffmpeg/libavcodec/utils.c:2107:19
    #11 0x589546 in decode_video /home/user/code/ffmpeg/ffmpeg.c:2069:11
    #12 0x589546 in process_input_packet /home/user/code/ffmpeg/ffmpeg.c:2318
    #13 0x5990bc in process_input /home/user/code/ffmpeg/ffmpeg.c:3980:5
    #14 0x5726c6 in transcode_step /home/user/code/ffmpeg/ffmpeg.c:4068:11
    #15 0x5726c6 in transcode /home/user/code/ffmpeg/ffmpeg.c:4122
    #16 0x56f73c in main /home/user/code/ffmpeg/ffmpeg.c:4314:9
    #17 0x7f9c7ee0bec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #18 0x466445 in _start (/home/user/Desktop/ffmpeg/ffmpeg_full+0x466445)

Attachments (1)

test_case.vp.ivf (936 bytes ) - added by tsmith 8 years ago.

Download all attachments as: .zip

Change History (3)

by tsmith, 8 years ago

Attachment: test_case.vp.ivf added

comment:1 by Ronald S. Bultje, 8 years ago

Resolution: fixed
Status: newclosed

comment:2 by Carl Eugen Hoyos, 8 years ago

Keywords: vp9 added
Note: See TracTickets for help on using tickets.