Opened 5 years ago
Closed 4 years ago
#8322 closed defect (fixed)
signed integer overflow at libswscale/output.c:2281
Reported by: | Suhwan | Owned by: | |
---|---|---|---|
Priority: | normal | Component: | swscale |
Version: | git-master | Keywords: | ubsan |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | no | |
Analyzed by developer: | no |
Description
Summary of the bug:
There're two signed integer overflow at libswscale/output.c:2281
I compiled ffmpeg with "--toolchain=clang-usan" to check the undefined-behaviours and attached log file.
How to reproduce:
% ffmpeg_g -y -i $PoC -target vcd -c fits tmp.rawvideo ffmpeg version N-95517-g0b8956b25c Copyright (c) 2000-2019 the FFmpeg developers built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final) configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-usan
Here's UBSAN log
libswscale/output.c:2281:35: runtime error: signed integer overflow: 524280 * 4432 cannot be represented in type 'int' Thread 1 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() () (gdb) bt #0 0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() () #1 0x000000000042b0eb in void handleIntegerOverflowImpl<__ubsan::Value>(__ubsan::OverflowData*, unsigned long, char const*, __ubsan::Value, __ubsan::ReportOptions) () #2 0x000000000042c9df in __ubsan_handle_mul_overflow () #3 0x0000000005706ada in yuv2gbrp16_full_X_c (c=0x93fee00, lumFilter=0x9416080, lumSrcx=0x9419000, lumFilterSize=4, chrFilter=0x9413280, chrUSrcx=0x93fdec0, chrVSrcx=0x9419d00, chrFilterSize=4, alpSrcx=0x9419e40, dest=0x7fffffffbba0, dstW=352, y=0) at libswscale/output.c:2281 #4 0x000000000556487c in any_vscale (c=<optimized out>, desc=<optimized out>, sliceY=<optimized out>, sliceH=<optimized out>) at libswscale/vscale.c:198 #5 0x0000000005529255 in swscale (c=<optimized out>, src=<optimized out>, srcStride=<optimized out>, srcSliceY=<optimized out>, srcSliceH=<optimized out>, dst=<optimized out>, dstStride=<optimized out>) at libswscale/swscale.c:503 #6 0x00000000055337c2 in sws_scale (c=0x93fee00, srcSlice=0x9408af4, srcStride=0x7fffffffc1d0, srcSliceY=0, srcSliceH=60, dst=<optimized out>, dstStride=0x7fffffffc1c0) at libswscale/swscale.c:978 #7 0x0000000000d361ee in scale_slice (link=<optimized out>, out_buf=<optimized out>, cur_pic=<optimized out>, sws=<optimized out>, y=<optimized out>, h=<optimized out>, mul=<optimized out>, field=<optimized out>) at libavfilter/vf_scale.c:411 #8 0x0000000000d31c9d in scale_frame (link=<optimized out>, in=0x9429080, frame_out=<optimized out>) at libavfilter/vf_scale.c:535 #9 0x0000000000d2f20d in filter_frame (link=0x93fb3c0, in=0x9429080) at libavfilter/vf_scale.c:549 #10 0x00000000005d002d in ff_filter_frame_framed (link=<optimized out>, frame=0x0) at libavfilter/avfilter.c:1084 #11 ff_filter_frame_to_filter (link=<optimized out>) at libavfilter/avfilter.c:1232 #12 ff_filter_activate_default (filter=<optimized out>) at libavfilter/avfilter.c:1281 #13 ff_filter_activate (filter=<optimized out>) at libavfilter/avfilter.c:1443 #14 0x00000000005f444f in push_frame (graph=0x93c7ec0) at libavfilter/buffersrc.c:187 #15 av_buffersrc_add_frame_internal (ctx=<optimized out>, frame=0x93f5700, flags=<optimized out>) at libavfilter/buffersrc.c:261 #16 0x00000000005f300e in av_buffersrc_add_frame_flags (ctx=0x93fac40, frame=0x93f5700, flags=4) at libavfilter/buffersrc.c:170 #17 0x00000000004cad80 in ifilter_send_frame (ifilter=<optimized out>, frame=<optimized out>) at fftools/ffmpeg.c:2186 #18 send_frame_to_filters (ist=0x93ca880, decoded_frame=0x93f5700) at fftools/ffmpeg.c:2260 #19 0x00000000004a07dc in decode_video (ist=<optimized out>, pkt=<optimized out>, got_output=<optimized out>, duration_pts=<optimized out>, eof=<optimized out>, decode_failed=<optimized out>) at fftools/ffmpeg.c:2459 #20 process_input_packet (ist=<optimized out>, pkt=<optimized out>, no_eof=<optimized out>) at fftools/ffmpeg.c:2613 #21 0x00000000004ba058 in process_input (file_index=0) at fftools/ffmpeg.c:4303 #22 0x000000000048d60b in transcode_step () at fftools/ffmpeg.c:4628 #23 transcode () at fftools/ffmpeg.c:4682 #24 0x0000000000487dc4 in main (argc=11, argv=<optimized out>) at fftools/ffmpeg.c:4884 (gdb) c Continuing. libswscale/output.c:2281:19: runtime error: signed integer overflow: -1073741824 + -1971358336 cannot be represented in type 'int' Thread 1 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() () (gdb) q
Please confirm.
Thanks
Attachments (1)
Change History (3)
by , 5 years ago
comment:1 by , 4 years ago
Status: | new → open |
---|
comment:2 by , 4 years ago
Component: | undetermined → swscale |
---|---|
Resolution: | → fixed |
Status: | open → closed |
Fixed by Michael in 49ba1879add99d3f64d70d34fb0255c8a49d4b28
Note:
See TracTickets
for help on using tickets.
poc