#10198 closed defect (fixed)

rka: crash with fuzzed file

Reported by: ami_stuff Owned by:
Priority: normal Component: undetermined
Version: unspecified Keywords:
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

also unrelated minor issue, there is an unclosed parenthesis in CODEC_LONG_NAME:

libavcodec/rka.c:

    CODEC_LONG_NAME("RKA (RK Audio"),
(gdb) r -i crash.rka -f null -
Starting program: ffmpeg_g -i crash.rka -f null -
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
ffmpeg version N-109863-g4113445e9d Copyright (c) 2000-2023 the FFmpeg developers
  built with gcc 9 (Ubuntu 9.4.0-1ubuntu1~20.04.1)
  configuration: 
  libavutil      58.  1.100 / 58.  1.100
  libavcodec     60.  2.100 / 60.  2.100
  libavformat    60.  2.100 / 60.  2.100
  libavdevice    60.  0.100 / 60.  0.100
  libavfilter     9.  1.100 /  9.  1.100
  libswscale      7.  0.100 /  7.  0.100
  libswresample   4.  9.100 /  4.  9.100
Guessed Channel Layout for Input Stream #0.0 : mono
Input #0, rka, from 'crash.rka':
  Duration: 00:00:10.00, start: 0.000000, bitrate: 103 kb/s
  Stream #0:0: Audio: rka, 33333 Hz, 1 channels, u8p
Stream mapping:
  Stream #0:0 -> #0:0 (rka (native) -> pcm_s16le (native))
Press [q] to stop, [?] for help
[New Thread 0x7ffff6bdd700 (LWP 17994)]
Error while decoding stream #0:0: Invalid data found when processing input
[Thread 0x7ffff6bdd700 (LWP 17994) exited]
[New Thread 0x7ffff63dc700 (LWP 17995)]
[New Thread 0x7ffff5bdb700 (LWP 17996)]
[New Thread 0x7ffff53da700 (LWP 17997)]
[New Thread 0x7ffff4bd9700 (LWP 17998)]
[New Thread 0x7fffeffff700 (LWP 17999)]
[New Thread 0x7fffef7fe700 (LWP 18000)]
[New Thread 0x7fffeeffd700 (LWP 18001)]
[New Thread 0x7fffee7fc700 (LWP 18002)]
    Last message repeated 2 times
Output #0, null, to 'pipe:':
  Metadata:
    encoder         : Lavf60.2.100
  Stream #0:0: Audio: pcm_s16le, 33333 Hz, mono, s16, 533 kb/s
    Metadata:
      encoder         : Lavc60.2.100 pcm_s16le
[New Thread 0x7fffedffb700 (LWP 18003)]
size=N/A time=-577014:32:22.77 bitrate=N/A speed=N/A    s/s speed=N/A    
video:0kB audio:0kB subtitle:0kB other streams:0kB global headers:0kB muxing overhead: unknown
[Thread 0x7fffedffb700 (LWP 18003) exited]
Output file is empty, nothing was encoded (check -ss / -t / -frames parameters if used)
[Thread 0x7fffeffff700 (LWP 17999) exited]
[Thread 0x7fffee7fc700 (LWP 18002) exited]
[Thread 0x7fffeeffd700 (LWP 18001) exited]
[Thread 0x7fffef7fe700 (LWP 18000) exited]
[Thread 0x7ffff4bd9700 (LWP 17998) exited]
[Thread 0x7ffff53da700 (LWP 17997) exited]
[Thread 0x7ffff5bdb700 (LWP 17996) exited]
[Thread 0x7ffff63dc700 (LWP 17995) exited]
--Type <RET> for more, q to quit, c to continue without paging--

Thread 1 "ffmpeg_g" received signal SIGSEGV, Segmentation fault.
__GI___libc_free (mem=0x16dd2feffe5527e) at malloc.c:3102
3102	malloc.c
(gdb) bt
#0  __GI___libc_free (mem=0x16dd2feffe5527e) at malloc.c:3102
#1  0x00005555556aaffd in adaptive_model_free (am=<optimized out>)
    at libavcodec/rka.c:956
#2  rka_decode_close (avctx=<optimized out>) at libavcodec/rka.c:956
#3  0x0000555555686bc0 in avcodec_close (avctx=avctx@entry=0x5555571616c0)
    at libavcodec/codec_internal.h:327
#4  0x0000555555e12d1d in avcodec_free_context (
    pavctx=pavctx@entry=0x555557161530) at libavcodec/options.c:175
#5  0x00005555556f4977 in ist_free (pist=0x55555715d9e0)
    at fftools/ffmpeg_demux.c:473
#6  ifile_close (pf=0x55555715c900) at fftools/ffmpeg_demux.c:490
#7  0x0000555555713de1 in ffmpeg_cleanup (ret=69) at fftools/ffmpeg.c:556
#8  0x000055555570a945 in exit_program (ret=69) at fftools/cmdutils.c:102
#9  0x00005555556f0bb3 in main (argc=6, argv=0x7fffffffdf78)
    at fftools/ffmpeg.c:4192

Attachments (1)

crash.rka (126.6 KB ) - added by ami_stuff 15 months ago.

Download all attachments as: .zip

Change History (2)

by ami_stuff, 15 months ago

Attachment: crash.rka added

comment:1 by Elon Musk, 15 months ago

Resolution: fixed
Status: newclosed
Note: See TracTickets for help on using tickets.