#7996 closed defect (duplicate)
Division by zero at libavcodec/lpc.h:155
Reported by: | Suhwan | Owned by: | |
---|---|---|---|
Priority: | normal | Component: | undetermined |
Version: | git-master | Keywords: | ubsan asan |
Cc: | Michael Niedermayer | Blocked By: | |
Blocking: | Reproduced by developer: | no | |
Analyzed by developer: | no |
Description
Summary of the bug:
There's division by zero at libavcodec/lpc.h:155 and heap buffer overflow at libavcodec/zmbvenc.c:97:30.
How to reproduce:
% ffmpeg_g -y -r 48 -i tmp.wmv -map 0 -c:s:4 zmbv -c:v zmbv -disposition:a:19 fits -disposition:v:29 xwd -vframes 34 -ab 922k -ar 48000 -ac 3 -b:v 501k tmp_.mov ffmpeg version : N-94163-g664a27ea40 built with clang version 9.0.0
135 static inline void compute_ref_coefs(const LPC_TYPE *autoc, int max_order, 136 LPC_TYPE *ref, LPC_TYPE *error) 137 { 138 int i, j; 139 LPC_TYPE err; 140 LPC_TYPE gen0[MAX_LPC_ORDER], gen1[MAX_LPC_ORDER]; 141 142 for (i = 0; i < max_order; i++) 143 gen0[i] = gen1[i] = autoc[i + 1]; 144 145 err = autoc[0]; 146 ref[0] = -gen1[0] / err; 147 err += gen1[0] * ref[0]; 148 if (error) 149 error[0] = err; 150 for (i = 1; i < max_order; i++) { 151 for (j = 0; j < max_order - i; j++) { 152 gen1[j] = gen1[j + 1] + ref[i - 1] * gen0[j]; 153 gen0[j] = gen1[j + 1] * ref[i - 1] + gen0[j]; 154 } 155 ref[i] = -gen1[0] / err; 156 err += gen1[0] * ref[i]; 157 if (error) 158 error[i] = err; 159 } 160 }
Attachments (2)
Change History (7)
by , 5 years ago
Attachment: | gdb_log_7996 added |
---|
by , 5 years ago
comment:2 by , 3 years ago
Cc: | added |
---|---|
Resolution: | → fixed |
Status: | new → closed |
The division by 0 happens in floating point and divisions by 0 in floating point are generally not bugs as such. If you disagree and see an issue with this division then please reopen this ticket
Completely unrelated to this the sample triggers a out of array read that has been fixed by def04022f4a7058f99e669bfd978d431d79aec18 so iam marking this as fixed
comment:4 by , 3 years ago
Resolution: | fixed → duplicate |
---|
comment:5 by , 3 years ago
I will post a patch to ffmpeg-devel to avoid the floating point division.
Note:
See TracTickets
for help on using tickets.