Opened 5 years ago

Closed 5 years ago

#8288 closed defect (fixed)

load of null pointer of type 'const uint16_t' at libavfilter/vf_colorchannelmixer.c:187

Reported by: Suhwan Owned by:
Priority: normal Component: undetermined
Version: git-master Keywords: ubsan
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:
There is a load of null pointer of type 'const uint16_t' at libavfilter/vf_colorchannelmixer.c:187

I compiled ffmpeg with "--toolchain=clang-usan" to check the undefined-behaviours and attached log file.
How to reproduce:

% ffmpeg_g -y -i $PoC -filter_complex colorchannelmixer -loglevel 0 tmp.dnxhd

ffmpeg version N-95399-g1a0c584abc Copyright (c) 2000-2019 the FFmpeg developers
built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-usan

Here's UBSAN log

libavfilter/vf_colorchannelmixer.c:187:34: runtime error: load of null pointer of type 'const uint16_t' (aka 'const unsigned short')
[Switching to Thread 0x7ffff5652700 (LWP 47209)]

Thread 2 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() ()
(gdb) bt
#0  0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() ()
#1  0x000000000042bfee in handleTypeMismatchImpl(__ubsan::TypeMismatchData*, unsigned long, __ubsan::ReportOptions) ()
#2  0x000000000042c841 in __ubsan_handle_type_mismatch_v1 ()
#3  0x00000000007c82df in filter_slice_rgba16_planar (ctx=<optimized out>, arg=<optimized out>, jobnr=<optimized out>, nb_jobs=<optimized out>, have_alpha=<optimized out>, depth=<optimized out>)
    at libavfilter/vf_colorchannelmixer.c:187
#4  filter_slice_gbrp10 (ctx=<optimized out>, arg=<optimized out>, jobnr=<optimized out>, nb_jobs=<optimized out>) at libavfilter/vf_colorchannelmixer.c:239
#5  0x0000000000663445 in worker_func (priv=0x93f3d40, jobnr=0, threadnr=<optimized out>, nb_jobs=<optimized out>, nb_threads=<optimized out>) at libavfilter/pthread.c:50
#6  0x00000000059d4778 in run_jobs (ctx=0x93f0380) at libavutil/slicethread.c:61
#7  0x00000000059d3586 in thread_worker (v=<optimized out>) at libavutil/slicethread.c:85
#8  0x00007ffff668e6db in start_thread (arg=0x7ffff5652700) at pthread_create.c:463
#9  0x00007ffff5d9388f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Please confirm.
Thanks

Attachments (1)

PoC_vf_colorchannelmixer_187.jpg (112.3 KB ) - added by Suhwan 5 years ago.
poc

Download all attachments as: .zip

Change History (2)

by Suhwan, 5 years ago

poc

comment:1 by Elon Musk, 5 years ago

Resolution: fixed
Status: newclosed
Note: See TracTickets for help on using tickets.