Opened 4 years ago

Closed 3 years ago

#8483 closed defect (fixed)

UBSan: outside the range of unsigned int

Reported by: andreafioraldi Owned by:
Priority: minor Component: avcodec
Version: git-master Keywords: ircam ubsan
Cc: Blocked By:
Blocking: Reproduced by developer: yes
Analyzed by developer: no

Description (last modified by Carl Eugen Hoyos)

Build ffmpeg 4.2.2 using clang and ubsan (-fsanitize=undefined).
Command line: ./ffmpeg.ubsan -y -i ./input -c:v mpeg4 -c:a out.mp4
Output:

ffmpeg version 4.2.2 Copyright (c) 2000-2019 the FFmpeg developers
  built with clang version 8.0.0-3~ubuntu18.04.2 (tags/RELEASE_800/final)
  configuration: --cc=clang-8 --cxx=clang++-8 --ld=clang-8
  libavutil      56. 31.100 / 56. 31.100
  libavcodec     58. 54.100 / 58. 54.100
  libavformat    58. 29.100 / 58. 29.100
  libavdevice    58.  8.100 / 58.  8.100
  libavfilter     7. 57.100 /  7. 57.100
  libswscale      5.  5.100 /  5.  5.100
  libswresample   3.  5.100 /  3.  5.100
Trailing options were found on the commandline.
libavformat/ircamdec.c:69:23: runtime error: -1.45475e+29 is outside the range of representable values of type 'unsigned int'
input_invalid_uint: Invalid data found when processing input

UBSan give the following error:
libavformat/ircamdec.c:69:23: runtime error: -4.25353e+37 is outside the range of representable values of type 'unsigned int'

Line 69 is (in case that the line number is misaligned in master):
sample_rate = av_int2float(avio_rl32(s->pb));

Not sure what is the bug here, I'm not enough confident with the codebase, but there is a bug cause UBSan has not false positive.

I attach a minimal input that triggers the bug in base64:
ZKMBAAAH6+8XDg4OIA==

Attachments (1)

input (13 bytes ) - added by Carl Eugen Hoyos 4 years ago.

Download all attachments as: .zip

Change History (3)

comment:1 by Carl Eugen Hoyos, 4 years ago

Description: modified (diff)
Keywords: ircam added
Priority: normalminor
Reproduced by developer: set
Status: newopen
Version: 4.2git-master

by Carl Eugen Hoyos, 4 years ago

Attachment: input added

comment:2 by Carl Eugen Hoyos, 3 years ago

Resolution: fixed
Status: openclosed
Note: See TracTickets for help on using tickets.