Opened 4 years ago

Closed 4 years ago

#8159 closed defect (fixed)

left shift of negative value bugs in libavcodec/truespeech.c

Reported by: Suhwan Owned by:
Priority: normal Component: avcodec
Version: git-master Keywords: ubsan
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:
There're 5 left shift of negative value bugs in libavcodec/truespeech.c

libavcodec/truespeech.c:136:53: runtime error: left shift of negative value -133
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/truespeech.c:136:53 in 
libavcodec/truespeech.c:259:30: runtime error: left shift of negative value -2
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/truespeech.c:259:30 in 
libavcodec/truespeech.c:277:27: runtime error: left shift of negative value -2
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/truespeech.c:277:27 in 
libavcodec/truespeech.c:285:26: runtime error: left shift of negative value -3
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/truespeech.c:285:26 in 
libavcodec/ac3enc.c:1068:37: runtime error: left shift of negative value -32

How to reproduce:

% ./ffmpeg_g -stream_loop 25 -y -i a6.wav -map 0 -vframes 8 -r 112 -ab 16k -ar 22050 -b:v 473k output/tmp.avi

ffmpeg version N-94943-g1db6e47e85
built on ubuntu 18.04 with clang-6 and UBSAN option.

Attachments (2)

gdb-truespeech​ (8.9 KB ) - added by Suhwan 4 years ago.
a6.wav​ (45.2 KB ) - added by Suhwan 4 years ago.
poc

Download all attachments as: .zip

Change History (4)

by Suhwan, 4 years ago

Attachment: gdb-truespeech​ added

by Suhwan, 4 years ago

Attachment: a6.wav​ added

poc

comment:1 by mkver, 4 years ago

Component: undetermined → avcodec

The ac3 related bug has been fixed in 2f289ec914cc7e8133858d4f9e8d91dab685ae44.

comment:2 by Elon Musk, 4 years ago

Resolution: → fixed
Status: new → closed

Fixed rest in 9b611deef176029750a498fe2369b4e7c7d0ffd6.

Note: See TracTickets for help on using tickets.