Opened 5 years ago

Closed 4 years ago

#8219 closed defect (fixed)

left shift of negative value bug in libswresample/audioconvert.c

Reported by: Suhwan Owned by:
Priority: normal Component: swresample
Version: git-master Keywords: ubsan
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:
There is a left shift of negative value bugs in libswresample/audioconvert.c

libswresample/audioconvert.c:62:1: runtime error: left shift of negative value -1376
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswresample/audioconvert.c:62:1 in 
libswresample/audioconvert.c:62:1: runtime error: left shift of negative value -5676
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswresample/audioconvert.c:62:1 in 
libswresample/audioconvert.c:62:1: runtime error: left shift of negative value -12748
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswresample/audioconvert.c:62:1 in 
libswresample/audioconvert.c:62:1: runtime error: left shift of negative value -15836
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswresample/audioconvert.c:62:1 in

How to reproduce:

% ffmpeg_g -stream_loop 29 -y -i $PoC -loglevel 0 -map 0 -c:a:71 mp2 -disposition:a:97 flv -disposition:s:18 apng -vframes 117 -aframes 67 -ab 506k -b:v 888k -strict 3 tmp.sox

ffmpeg version N-95199-g9847380f5f Copyright (c) 2000-2019 the FFmpeg developers
  built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
  configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-usan

Attachments (2)

gdb-audioconvert​ (10.7 KB ) - added by Suhwan 5 years ago.
PoC_audioconvert.au​ (6.9 KB ) - added by Suhwan 5 years ago.
poc

Download all attachments as: .zip

Change History (3)

by Suhwan, 5 years ago

Attachment: gdb-audioconvert​ added

by Suhwan, 5 years ago

Attachment: PoC_audioconvert.au​ added

poc

comment:1 by mkver, 4 years ago

Component: undetermined → swresample
Resolution: → fixed
Status: new → closed

Fixed in 9d8f9b2e4094ae6b07a9f23ae044b802722b3b4e.

Note: See TracTickets for help on using tickets.