Opened 3 years ago

Closed 3 years ago

#8291 closed defect (fixed)

outside the range of representable values of type 'unsigned int' at libavfilter/af_replaygain.c:570

Reported by: Suhwan Owned by:
Priority: normal Component: undetermined
Version: git-master Keywords: ubsan
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no


Summary of the bug:
There is an outside the range of representable values of type 'unsigned int' at libavfilter/af_replaygain.c:570

I compiled ffmpeg with "--toolchain=clang-usan" to check the undefined-behaviours and attached log file.
How to reproduce:

% ffmpeg_g -y -i $PoC -filter_complex replaygain -loglevel 0 tmp.tta

ffmpeg version N-95399-g1a0c584abc Copyright (c) 2000-2019 the FFmpeg developers
built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-usan

Here's UBSAN log

libavfilter/af_replaygain.c:570:13: runtime error: -65 is outside the range of representable values of type 'unsigned int'

Thread 1 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() ()
(gdb) bt
#0  0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() ()
#1  0x000000000042a4e6 in handleFloatCastOverflow(void*, unsigned long, __ubsan::ReportOptions) ()
#2  0x000000000042cd11 in __ubsan_handle_float_cast_overflow ()
#3  0x000000000124a0f4 in filter_frame (inlink=<optimized out>, in=<optimized out>) at libavfilter/af_replaygain.c:570
#4  0x00000000005cfe9d in ff_filter_frame_framed (link=<optimized out>, frame=0x0) at libavfilter/avfilter.c:1084
#5  ff_filter_frame_to_filter (link=<optimized out>) at libavfilter/avfilter.c:1232
#6  ff_filter_activate_default (filter=<optimized out>) at libavfilter/avfilter.c:1281
#7  ff_filter_activate (filter=<optimized out>) at libavfilter/avfilter.c:1443
#8  0x00000000005f42bf in push_frame (graph=0x93e1f80) at libavfilter/buffersrc.c:187
#9  av_buffersrc_add_frame_internal (ctx=<optimized out>, frame=0x93e5540, flags=<optimized out>) at libavfilter/buffersrc.c:261
#10 0x00000000005f2e7e in av_buffersrc_add_frame_flags (ctx=0x93f8340, frame=0x93e5540, flags=4) at libavfilter/buffersrc.c:170
#11 0x00000000004cad60 in ifilter_send_frame (ifilter=<optimized out>, frame=<optimized out>) at fftools/ffmpeg.c:2186
#12 send_frame_to_filters (ist=0x93e22c0, decoded_frame=0x93e5540) at fftools/ffmpeg.c:2260
#13 0x000000000049ba81 in decode_audio (ist=<optimized out>, pkt=<optimized out>, got_output=<optimized out>, decode_failed=<optimized out>) at fftools/ffmpeg.c:2327
#14 process_input_packet (ist=<optimized out>, pkt=0x7fffffffc9c0, no_eof=0) at fftools/ffmpeg.c:2609
#15 0x00000000004bf0f0 in process_input (file_index=<optimized out>) at fftools/ffmpeg.c:4508
#16 0x000000000048d5eb in transcode_step () at fftools/ffmpeg.c:4628
#17 transcode () at fftools/ffmpeg.c:4682
#18 0x0000000000487da4 in main (argc=9, argv=<optimized out>) at fftools/ffmpeg.c:4884

Please confirm.

Attachments (1)

PoC_af_replaygain_570.wav (125.0 KB ) - added by Suhwan 3 years ago.

Download all attachments as: .zip

Change History (2)

by Suhwan, 3 years ago

Attachment: PoC_af_replaygain_570.wav added


comment:1 by Elon Musk, 3 years ago

Resolution: fixed
Status: newclosed
Note: See TracTickets for help on using tickets.