Opened 20 months ago

#11350 new defect

signed integer overflow in libavcodec/h264_parser.c

Reported by: skorpion98 Owned by:
Priority: normal Component: avcodec
Version: git-master Keywords: ubsan, overflow
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug: Signed integer overflow in libavcodec/h264_parser.c:651:33

How to reproduce:
In the archive uploaded to the "VideoLAN File Uploader" you will find:

  • the executable on which we performed our tests, a compiled version of the ffmpeg_DEMUXER_fuzzer fuzzing harness you made
  • a directory bug containing the input that caused the aforementioned bug and its UBSan log

To reproduce the errors, simply run the given binary with the testcase files with a command like: ./ffmpeg_DEMUXER_fuzzer /path_to_testcases/input.

The program has been tested on the standard Docker image provided on OSS-Fuzz using Ubuntu 20.04, using AFL++ as fuzzing engine and the standard sanitizers flags used by OSS-Fuzz for ASan and UBSan.

The hash commit used to perform the tests is eb79c31.

UBSan output:

Reading 18374 bytes from /bugs/ffmpeg/signed_integer_overflow_avcodec_02
libavcodec/h264_parser.c:651:33: runtime error: signed integer overflow: -9223372036854775808 + -9223372036854775808 cannot be represented in type 'int64_t' (aka 'long')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/h264_parser.c:651:33

Change History (0)

Note: See TracTickets for help on using tickets.