signed integer overflow in libavformat/icodec.c

[skorpion98]

Summary of the bug: Signed integer overflow in libavformat/icodec.c:175:42

How to reproduce:
In the archive uploaded to the "VideoLAN File Uploader" you will find:

• the executable on which we performed our tests, a compiled version of the ffmpeg_DEMUXER_fuzzer fuzzing harness you made
• a directory bug containing the input that caused the aforementioned bug and its UBSan log

To reproduce the errors, simply run the given binary with the testcase files with a command like: ./ffmpeg_DEMUXER_fuzzer /path_to_testcases/input.

The program has been tested on the standard Docker image provided on OSS-Fuzz using Ubuntu 20.04, using AFL++ as fuzzing engine and the standard sanitizers flags used by OSS-Fuzz for ASan and UBSan.

The hash commit used to perform the tests is eb79c31.

UBSan output:

Reading 51 bytes from /bugs/ffmpeg/signed_integer_overflow_avformat_03
libavformat/icodec.c:175:42: runtime error: signed integer overflow: 14 + 2147483647 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavformat/icodec.c:175:42