Opened 5 years ago
Closed 4 years ago
#8350 closed defect (fixed)
signed integer overflow encoding ffv1
Reported by: | Suhwan | Owned by: | |
---|---|---|---|
Priority: | normal | Component: | avcodec |
Version: | git-master | Keywords: | ffv1 ubsan |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | no | |
Analyzed by developer: | no |
Description
Summary of the bug:
There is a signed integer overflow at libavcodec/put_bits.h:56
I compiled ffmpeg with "--toolchain=clang-usan" to check the undefined-behaviours and attached log file.
How to reproduce:
% ffmpeg_g -y -r 62 -i $PoC -loglevel 0 -vbsf mov2textsub -c ffv1 tmp.mjpeg ffmpeg version N-95604-g881f083a16 Copyright (c) 2000-2019 the FFmpeg developers built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final) configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain=clang-usan
Here's UBSAN log
libavcodec/put_bits.h:56:25: runtime error: signed integer overflow: 8 * 296117757 cannot be represented in type 'int' Thread 1 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() () (gdb) bt #0 0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() () #1 0x000000000042b0eb in void handleIntegerOverflowImpl<__ubsan::Value>(__ubsan::OverflowData*, unsigned long, char const*, __ubsan::Value, __ubsan::ReportOptions) () #2 0x000000000042c9df in __ubsan_handle_mul_overflow () #3 0x00000000020c93f7 in init_put_bits (s=<optimized out>, buffer=0x7fff7dfe3043 "", buffer_size=296117757) at libavcodec/put_bits.h:56 #4 encode_slice (c=0x9416480, arg=<optimized out>) at libavcodec/ffv1enc.c:1078 #5 0x0000000002ed372a in worker_func (priv=0x9416480, jobnr=0, threadnr=<optimized out>, nb_jobs=<optimized out>, nb_threads=<optimized out>) at libavcodec/pthread_slice.c:71 #6 0x0000000005a0d108 in run_jobs (ctx=0x976cc40) at libavutil/slicethread.c:61 #7 0x0000000005a0cdbf in avpriv_slicethread_execute (ctx=<optimized out>, nb_jobs=<optimized out>, execute_main=0) at libavutil/slicethread.c:188 #8 0x0000000002ed2a4d in thread_execute (avctx=<optimized out>, func=<optimized out>, arg=<optimized out>, ret=<optimized out>, job_count=<optimized out>, job_size=<optimized out>) at libavcodec/pthread_slice.c:110 #9 0x00000000020bf7fe in encode_frame (avctx=0x9416480, pkt=0x976c840, pict=0x9778040, got_packet=0x7fffffffc284) at libavcodec/ffv1enc.c:1233 #10 0x000000000200739f in avcodec_encode_video2 (avctx=0x9416480, avpkt=<optimized out>, frame=<optimized out>, got_packet_ptr=0x7fffffffc284) at libavcodec/encode.c:302 #11 0x00000000020090d0 in do_encode (avctx=0x9416480, frame=0x9778040, got_packet=0x7fffffffc284) at libavcodec/encode.c:371 #12 0x0000000002008c4a in avcodec_send_frame (avctx=0x9416480, frame=0x9778040) at libavcodec/encode.c:420 #13 0x00000000004c5228 in do_video_out (of=0x9403cc0, ost=<optimized out>, next_picture=<optimized out>, sync_ipts=4.9406564584124654e-324) at fftools/ffmpeg.c:1288 #14 0x00000000004c0f5b in reap_filters (flush=0) at fftools/ffmpeg.c:1505 #15 0x000000000048d6b2 in transcode_step () at fftools/ffmpeg.c:4639 #16 transcode () at fftools/ffmpeg.c:4683 #17 0x0000000000487dc4 in main (argc=13, argv=<optimized out>) at fftools/ffmpeg.c:4885
Please confirm.
Thanks
Attachments (1)
Change History (3)
by , 5 years ago
comment:1 by , 5 years ago
Component: | undetermined → avcodec |
---|---|
Keywords: | ffv1 ubsan added |
Summary: | signed integer overflow at libavcodec/put_bits.h:56 → signed integer overflow encoding ffv1 |
comment:2 by , 4 years ago
Resolution: | → fixed |
---|---|
Status: | new → closed |
Fixed in e7cbbd90267de2a0ad1b5fa8ccb29ab7bf8a26b8.
Note:
See TracTickets
for help on using tickets.
poc