Opened 5 years ago

Closed 5 years ago

#8145 closed defect (fixed)

left shift of negative value bugs in libavcodec/aptx.c

Reported by: Suhwan Owned by:
Priority: important Component: avcodec
Version: git-master Keywords: ubsan
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:
There're 6 left shift of negative value bugs and a left shift of large number bug in libavcodec/aptx.c

libavcodec/aptx.c:497:38: runtime error: left shift of 622133197 by 23 places cannot be represented in type 'int32_t' (aka 'int')
libavcodec/aptx.c:767:90: runtime error: left shift of negative value -21
libavcodec/aptx.c:762:38: runtime error: left shift of negative value -81503
libavcodec/aptx.c:804:52: runtime error: left shift of negative value -1
libavcodec/aptx.c:833:48: runtime error: left shift of negative value -24576
libavcodec/aptx.c:483:72: runtime error: left shift of 251900672 by 4 places cannot be represented in type 'int32_t' (aka 'int')
libavcodec/aptx.c:495:12: runtime error: left shift of negative value -10715331219032

How to reproduce:

% ./ffmpeg_g -y -i Choral.mpc -map 0 -vframes 38 -aframes 109 output/tmp.aptx
ffmpeg version N-94887-ge55018ee11 (git master)
built on ... ubuntu 18.04 with clang-6 and UBSAN option.

Attachments (1)

Choral.mpc (846.7 KB ) - added by Suhwan 5 years ago.
poc

Download all attachments as: .zip

Change History (2)

by Suhwan, 5 years ago

Attachment: Choral.mpc added

poc

comment:1 by mkver, 5 years ago

Component: undeterminedavcodec
Resolution: fixed
Status: newclosed
Note: See TracTickets for help on using tickets.