Opened 12 months ago

Last modified 12 months ago

#11691 new defect

[Security] heap-buffer-overflow on yuv2rgb.c:558

Reported by: flyfish101 Owned by:
Priority: important Component: swscale
Version: git-master Keywords: fuzz
Cc: Michael Niedermayer, Niklas Haas Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:

fuzz@Fuzz2:~/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz$ ./target_sws_fuzzer1143 /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1143/default/crashes/id:000495,sig:06,src:015818_time:53332181_execs:35594827_op:havoc_rep:2
Reading 132 bytes from /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1143/default/crashes/id:000495,sig:06,src:015818_time:53332181_execs:35594827_op:havoc_rep:2
2 x 2 yuv422p -> 2 x 2 rgb4
[swscaler @ 0x62f000000400] No accelerated colorspace conversion found from yuv422p to rgb4.
libswscale/swscale.c:1127:17: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1127:17 in 
libswscale/swscale.c:1129:17: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1129:17 in 
libswscale/swscale.c:1130:17: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1130:17 in 
libswscale/swscale.c:1131:17: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libswscale/swscale.c:1131:17 in 
=================================================================
==2095131==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60e0000000e0 at pc 0x555555b15e9a bp 0x7fffffffc790 sp 0x7fffffffc788
READ of size 1 at 0x60e0000000e0 thread T0
    #0 0x555555b15e99 in yuv422p_bgr4 /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/yuv2rgb.c:558:1
    #1 0x55555599ce4c in scale_internal /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1160:15
    #2 0x5555559a94ca in sws_scale /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1514:12
    #3 0x555555968c32 in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1143.c:197:9
    #4 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7
    #5 0x55555595f188 in LLVMFuzzerRunDriver /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c
    #6 0x55555595ed48 in main /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300:10
    #7 0x7ffff7c3b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #8 0x555555869fdd in _start (/home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/target_sws_fuzzer1143+0x315fdd)

0x60e0000000e0 is located 32 bytes to the left of 96-byte region [0x60e000000100,0x60e000000160)
allocated by thread T0 here:
    #0 0x55555591951c in posix_memalign /home/fuzz/Desktop/fuzz-introspector/build/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x555556375474 in av_malloc /home/fuzz/Desktop/projects_oss/FFmpeg/libavutil/mem.c:107:9
    #2 0x55555637691b in av_mallocz /home/fuzz/Desktop/projects_oss/FFmpeg/libavutil/mem.c:258:17
    #3 0x55555596a96e in alloc_plane /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1143.c:65:23
    #4 0x5555559672e6 in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1143.c:156:11
    #5 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/yuv2rgb.c:558:1 in yuv422p_bgr4
Shadow bytes around the buggy address:
  0x0c1c7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
=>0x0c1c7fff8010: 00 00 00 00 fa fa fa fa fa fa fa fa[fa]fa fa fa
  0x0c1c7fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
  0x0c1c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1c7fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
  0x0c1c7fff8050: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c1c7fff8060: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2095131==ABORTING

Attachments (2)

crash-495​ (132 bytes ) - added by flyfish101 12 months ago.
poc file
target_sws_fuzzer1143.c​ (6.6 KB ) - added by flyfish101 12 months ago.
fuzz driver

Download all attachments as: .zip

Change History (3)

by flyfish101, 12 months ago

Attachment: crash-495​ added

poc file

by flyfish101, 12 months ago

Attachment: target_sws_fuzzer1143.c​ added

fuzz driver

comment:1 by Michael Niedermayer, 12 months ago

Cc: Michael Niedermayer Niklas Haas added
Note: See TracTickets for help on using tickets.