Opened 5 weeks ago

Closed 5 weeks ago

#8143 closed defect (fixed)

left shift of negative value in libavformat/rmdec.c

Reported by: Suhwan Owned by:
Priority: normal Component: avformat
Version: git-master Keywords: ubsan
Cc: Blocked By:
Blocking: Reproduced by developer: yes
Analyzed by developer: yes

Description

Summary of the bug:
There's a left shift of negative value bug in libavformat/rmdec.c:727:41

libavformat/rmdec.c:727:41: runtime error: left shift of negative value -1
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavformat/rmdec.c:727:41 in 

How to reproduce:

% ./ffmpeg_g -y -i thankyou.rm -map 0 -c copy -c: v:79 targa -disposition: a:122 dpx -disposition: v:100 pcm_vidc -vframes 73 -aframes 50 -r 17 -ab 724k -ar 22050 -ac 10 -strict 0 output/tmp.ffmetadata

ffmpeg version N-94887-ge55018ee11 (git master)
built on ... ubuntu 18.04 with clang-6 and UBSAN option.

Attachments (2)

thankyou.rm (89.0 KB) - added by Suhwan 5 weeks ago.
gdb-left-rmdec (13.3 KB) - added by Suhwan 5 weeks ago.

Download all attachments as: .zip

Change History (5)

Changed 5 weeks ago by Suhwan

Changed 5 weeks ago by Suhwan

comment:1 Changed 5 weeks ago by jamrial

  • Analyzed by developer set
  • Component changed from undetermined to avformat
  • Priority changed from important to normal
  • Reproduced by developer set
  • Resolution set to fixed
  • Status changed from new to closed

comment:2 Changed 5 weeks ago by Cubittus

  • Resolution fixed deleted
  • Status changed from closed to reopened

This patch does not compile:

src/libavformat/rmdec.c: In function ‘rm_sync’:
src/libavformat/rmdec.c:727:36: error: invalid operands to binary >> (have ‘AVIOContext *’ {aka ‘struct AVIOContext *’} and ‘int’)
  727 |             mlti_id = avio_r8((pb) >> 1) - 1;
      |                                    ^~

comment:3 Changed 5 weeks ago by jamrial

  • Resolution set to fixed
  • Status changed from reopened to closed

Yes, my mistake. Fixed in 4c34ed65f68542ab5d1b0be0e26716ae74df0d23.

Note: See TracTickets for help on using tickets.