Opened 20 months ago

Last modified 20 months ago

#11346 new defect

signed integer overflow in libavformat/demux.c

Reported by: skorpion98 Owned by:
Priority: normal Component: avcodec
Version: git-master Keywords: ubsan, overflow
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description (last modified by skorpion98)

Summary of the bug: Signed integer overflow in libavformat/demux.c:804

How to reproduce:
In the archive uploaded to the "VideoLAN File Uploader" you will find:

  • the executable on which we performed our tests, a compiled version of the ffmpeg_DEMUXER_fuzzer fuzzing harness you made
  • a directory bug containing the input that caused the aforementioned bug and its UBSan log

To reproduce the errors, simply run the given binary with the testcase files with a command like:
./ffmpeg_DEMUXER_fuzzer /path_to_testcases/input.

The program has been tested on the standard Docker image provided on OSS-Fuzz using Ubuntu 20.04, using AFL++ as fuzzing engine and the standard sanitizers flags used by OSS-Fuzz for ASan and UBSan.

The hash commit used to perform the tests is eb79c31.

UBSan output:

Reading 8517 bytes from /bugs/ffmpeg/signed_integer_overflow_avformat_01
libavformat/demux.c:804:36: runtime error: signed integer overflow: -9223371749632982144 - 1907869387765793664 cannot be represented in type 'int64_t' (aka 'long')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavformat/demux.c:804:36

Change History (1)

comment:1 by skorpion98, 20 months ago

Description: modified (diff)
Note: See TracTickets for help on using tickets.