[Security] heap-buffer-overflow on alphablend.c:77

[flyfish101]

Summary of the bug:

fuzz@Fuzz2:~/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz$ ./target_sws_fuzzer_1519 /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1519/default/crashes/id:000000,sig:06,src:000005+000654_time:74588_execs:28040_op:splice_rep:8
Reading 168 bytes from /home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/out_sws_1519/default/crashes/id:000000,sig:06,src:000005+000654_time:74588_execs:28040_op:splice_rep:8
4514 x 1 yuva420p9be -> 1 x 1 yuv420p (alphablend: checkerboard)
=================================================================
==3958937==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000004c80 at pc 0x555555c49927 bp 0x7fffffffc1d0 sp 0x7fffffffc1c8
READ of size 2 at 0x625000004c80 thread T0
    #0 0x555555c49926 in ff_sws_alphablendaway /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/alphablend.c:77:57
    #1 0x55555599dfec in scale_internal /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1160:15
    #2 0x5555559b35d5 in scale_cascaded /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:987:15
    #3 0x555555997eef in scale_internal /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1056:16
    #4 0x5555559aa66a in sws_scale /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/swscale.c:1514:12
    #5 0x555555969dd8 in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1519.c:215:5
    #6 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7
    #7 0x55555595f188 in LLVMFuzzerRunDriver /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c
    #8 0x55555595ed48 in main /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300:10
    #9 0x7ffff7c3b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #10 0x555555869fdd in _start (/home/fuzz/Desktop/projects_oss/FFmpeg/tools/fuzzout/sws_fuzz/target_sws_fuzzer_1519+0x315fdd)

0x625000004c80 is located 0 bytes to the right of 9088-byte region [0x625000002900,0x625000004c80)
allocated by thread T0 here:
    #0 0x55555591951c in posix_memalign /home/fuzz/Desktop/fuzz-introspector/build/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x555556376614 in av_malloc /home/fuzz/Desktop/projects_oss/FFmpeg/libavutil/mem.c:107:9
    #2 0x555556377abb in av_mallocz /home/fuzz/Desktop/projects_oss/FFmpeg/libavutil/mem.c:258:17
    #3 0x55555596bb0e in alloc_plane /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1519.c:66:23
    #4 0x5555559685b6 in LLVMFuzzerTestOneInput /home/fuzz/Desktop/projects_oss/FFmpeg/tools/./target_sws_fuzzer1519.c:176:11
    #5 0x55555595f37d in ExecuteFilesOnyByOne /home/fuzz/Desktop/DDGF_Project/AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255:7

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fuzz/Desktop/projects_oss/FFmpeg/libswscale/alphablend.c:77:57 in ff_sws_alphablendaway
Shadow bytes around the buggy address:
  0x0c4a7fff8940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff8950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff8960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff8970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff8980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4a7fff8990:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff89a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff89b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff89c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff89d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff89e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3958937==ABORTING

[flyfish101]

poc file

[flyfish101]

fuzz driver

[kasper93]

FYI: Security issues should be reported to ​ffmpeg-security@ffmpeg.org

not all buffers overflow are made equal, but I think generally such fuzzed input is communicated to ​ffmpeg-security@ffmpeg.org first.

thanks.

[flyfish101]

OK, thanks

Replying to kasper93:

FYI: Security issues should be reported to ​ffmpeg-security@ffmpeg.org

not all buffers overflow are made equal, but I think generally such fuzzed input is communicated to ​ffmpeg-security@ffmpeg.org first.

thanks.

[Michael Niedermayer]

Please use the fuzzer we have without modifications. If you want to improve the fuzzer submit a patch to it. If you really have to modify it explain what and why it was modified. Is this report AI generated ?

[flyfish101]

Replying to Michael Niedermayer:

Please use the fuzzer we have without modifications. If you want to improve the fuzzer submit a patch to it. If you really have to modify it explain what and why it was modified. Is this report AI generated ?

In this example, we modified the hardcoded alphablend setting in the driver:

av_opt_set(sws, "alphablend", "none", 0);

to enable more alphablend modes. See this line:
​https://trac.ffmpeg.org/attachment/ticket/11692/target_sws_fuzzer1519.c#L208

You can read this paper, which explains why it is important to modify and refine the current fuzz driver.

​https://thuanpv.github.io/publications/Fuzzing23_FuzzBlockers.pdf

In short, We are using LLM to help us analyze the existing bottlenecks in fuzzing and to explore more code paths. If you're interested, we could explore deeper research and collaboration. By the way, please check these bugs :)

[Niklas Haas]

​https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20063