Opened 20 months ago

#11347 new defect

signed integer overflow in libavformat/rpl.c

Reported by: skorpion98 Owned by:
Priority: normal Component: avformat
Version: git-master Keywords: ubsan, overflow
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug: Signed integer overflow in libavformat/rpl.c:107:19

How to reproduce:
In the archive uploaded to the "VideoLAN File Uploader" you will find:

  • the executable on which we performed our tests, a compiled version of the ffmpeg_DEMUXER_fuzzer fuzzing harness you made
  • a directory bug containing the input that caused the aforementioned bug and its UBSan log

To reproduce the errors, simply run the given binary with the testcase files with a command like: ./ffmpeg_DEMUXER_fuzzer /path_to_testcases/input.

The program has been tested on the standard Docker image provided on OSS-Fuzz using Ubuntu 20.04, using AFL++ as fuzzing engine and the standard sanitizers flags used by OSS-Fuzz for ASan and UBSan.

The hash commit used to perform the tests is eb79c31.

UBSan output:

Reading 97 bytes from /bugs/ffmpeg/signed_integer_overflow_avformat_02
libavformat/rpl.c:107:19: runtime error: signed integer overflow: 10 * -2132125468444888889 cannot be represented in type 'int64_t' (aka 'long')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavformat/rpl.c:107:19

Change History (0)

Note: See TracTickets for help on using tickets.