Opened 12 months ago

Last modified 12 months ago

#11689 new defect

[Security] Division by zero on libswscale/utils.c:1408:60

Reported by: flyfish101 Owned by:
Priority: important Component: swscale
Version: git-master Keywords: fuzzer
Cc: flyfish101, Michael Niedermayer, Niklas Haas Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:

fuzz@Fuzz2:~/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz$ ./target_sws_fuzzer1051 /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1051/default/crashes/id:000457,sig:08,src:014662_time:386353182_execs:207939645_op:havoc_rep:16
Reading 224 bytes from /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1051/default/crashes/id:000457,sig:08,src:014662_time:386353182_execs:207939645_op:havoc_rep:16
8 x 474 gray12be -> 8 x 1 yuv410p
libswscale/utils.c:1408:60: runtime error: division by zero
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/utils.c:1408:60 in 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1625492==ERROR: AddressSanitizer: FPE on unknown address 0x5555557b8a46 (pc 0x5555557b8a46 bp 0x7fffffffcd70 sp 0x7fffffffcaa0 T0)
    #0 0x5555557b8a46 in ff_sws_init_single_context /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/utils.c:1408:60
    #1 0x5555559689db in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1051.c:178:11
    #2 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7
    #3 0x55555595f188 in LLVMFuzzerRunDriver /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c
    #4 0x55555595ed48 in main /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300:10
    #5 0x7ffff7c3b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #6 0x555555869fdd in _start (/home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/target_sws_fuzzer1051+0x315fdd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/utils.c:1408:60 in ff_sws_init_single_context
==1625492==ABORTING

Attachments (2)

sws_div_zero (224 bytes ) - added by flyfish101 12 months ago.
poc file
target_sws_fuzzer1051.c (5.9 KB ) - added by flyfish101 12 months ago.
sws fuzz driver

Download all attachments as: .zip

Change History (3)

by flyfish101, 12 months ago

Attachment: sws_div_zero added

poc file

by flyfish101, 12 months ago

Attachment: target_sws_fuzzer1051.c added

sws fuzz driver

comment:1 by Michael Niedermayer, 12 months ago

Cc: Michael Niedermayer Niklas Haas added
Note: See TracTickets for help on using tickets.