Opened 5 years ago
Closed 4 years ago
#8323 closed defect (fixed)
signed integer overflow at libavfilter/vf_aspect.c:81
Reported by: | Suhwan | Owned by: | |
---|---|---|---|
Priority: | normal | Component: | undetermined |
Version: | git-master | Keywords: | ubsan |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | yes | |
Analyzed by developer: | no |
Description
Summary of the bug:
There're two signed integer overflow at libavfilter/vf_aspect.c:81
I compiled ffmpeg with "--toolchain=clang-usan" to check the undefined-behaviours and attached log file.
How to reproduce:
% ffmpeg_g -i $PoC -filter_complex setsar -target dv -loglevel 0 tmp.vc1test ffmpeg version N-95517-g0b8956b25c Copyright (c) 2000-2019 the FFmpeg developers built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final) configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-usan
Here's UBSAN log
libavfilter/vf_aspect.c:81:49: runtime error: signed integer overflow: 1562273630 * 17 cannot be represented in type 'int' Thread 1 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() () (gdb) bt #0 0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() () #1 0x000000000042b0eb in void handleIntegerOverflowImpl<__ubsan::Value>(__ubsan::OverflowData*, unsigned long, char const*, __ubsan::Value, __ubsan::ReportOptions) () #2 0x000000000042c9df in __ubsan_handle_mul_overflow () #3 0x0000000000695c1f in compute_dar (dar=0x7fffffffbff0, sar=..., w=17, h=<optimized out>) at libavfilter/vf_aspect.c:81 #4 0x0000000000695ddf in setsar_config_props (outlink=0x96c8f80) at libavfilter/vf_aspect.c:215 #5 0x00000000005c60a6 in avfilter_config_links (filter=0x96c8bc0) at libavfilter/avfilter.c:318 #6 0x00000000005c604c in avfilter_config_links (filter=0x96c9140) at libavfilter/avfilter.c:307 #7 0x00000000005c604c in avfilter_config_links (filter=0x96c8900) at libavfilter/avfilter.c:307 #8 0x00000000005d8a02 in graph_config_links (graph=<optimized out>, log_ctx=<optimized out>) at libavfilter/avfiltergraph.c:261 #9 avfilter_graph_config (graphctx=<optimized out>, log_ctx=0x0) at libavfilter/avfiltergraph.c:1279 #10 0x000000000046a53f in configure_filtergraph (fg=<optimized out>) at fftools/ffmpeg_filter.c:1109 #11 0x00000000004cad35 in ifilter_send_frame (ifilter=<optimized out>, frame=<optimized out>) at fftools/ffmpeg.c:2179 #12 send_frame_to_filters (ist=0x93cae00, decoded_frame=0x96c17c0) at fftools/ffmpeg.c:2260 #13 0x00000000004a07dc in decode_video (ist=<optimized out>, pkt=<optimized out>, got_output=<optimized out>, duration_pts=<optimized out>, eof=<optimized out>, decode_failed=<optimized out>) at fftools/ffmpeg.c:2459 #14 process_input_packet (ist=<optimized out>, pkt=<optimized out>, no_eof=<optimized out>) at fftools/ffmpeg.c:2613 #15 0x00000000004ba058 in process_input (file_index=0) at fftools/ffmpeg.c:4303 #16 0x000000000048d60b in transcode_step () at fftools/ffmpeg.c:4628 #17 transcode () at fftools/ffmpeg.c:4682 #18 0x0000000000487dc4 in main (argc=10, argv=<optimized out>) at fftools/ffmpeg.c:4884 (gdb) c Continuing. libavfilter/vf_aspect.c:81:62: runtime error: signed integer overflow: 1022679769 * 17 cannot be represented in type 'int'
Please confirm.
Thanks
Attachments (1)
Change History (2)
by , 5 years ago
comment:1 by , 4 years ago
Reproduced by developer: | set |
---|---|
Resolution: | → fixed |
Status: | new → closed |
Note:
See TracTickets
for help on using tickets.
poc