Opened 20 months ago

#11348 new defect

signed integer overflow in libavcodec/g723_1_parser.c

Reported by: skorpion98 Owned by:
Priority: normal Component: avcodec
Version: git-master Keywords: ubsan, overflow
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug: Signed integer overflow in libavcodec/g723_1_parser.c:40:39

How to reproduce:
In the archive uploaded to the "VideoLAN File Uploader" you will find:

  • the executable on which we performed our tests, a compiled version of the ffmpeg_DEMUXER_fuzzer fuzzing harness you made
  • a directory bug containing the input that caused the aforementioned bug and its UBSan log

To reproduce the errors, simply run the given binary with the testcase files with a command like: ./ffmpeg_DEMUXER_fuzzer /path_to_testcases/input.

The program has been tested on the standard Docker image provided on OSS-Fuzz using Ubuntu 20.04, using AFL++ as fuzzing engine and the standard sanitizers flags used by OSS-Fuzz for ASan and UBSan.

The hash commit used to perform the tests is eb79c31.

UBSan output:

Reading 653 bytes from /bugs/ffmpeg/signed_integer_overflow_avcodec_01
libavcodec/g723_1_parser.c:40:39: runtime error: signed integer overflow: 24 * 1347901695 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/g723_1_parser.c:40:39

Change History (0)

Note: See TracTickets for help on using tickets.