#11064: Potential crash when calling libass
-------------------------------------+-------------------------------------
Reporter: Spencer Wu | Type: defect
Status: new | Priority: minor
Component: avfilter | Version:
| unspecified
Keywords: | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
-------------------------------------+-------------------------------------
Hi FFmpeg developers,
We are a team working on experimental program analysis features based on
fuzzing. Recently when tracking the usage of libass, we notice that the
function call to `ass_process_chunk` is passing data buffer `ass_line`
with size of data determined with `strlen` in
`libavfilter/vf_subtitles.c`.
While the call dependency being long and not a crash discovered by running
full FFmpeg, we wondered whether there will be a chance for `ass_line`
being passed with non null-byte terminated string, resulting in
calculating the wrong length of data to process for `ass_process_chunk`?
Similar doubt happens at the locations of calling
`ass_process_codec_private` and `ass_add_font` as well.
We attach the automatic synthesized fuzzing harness we used to discover
this potential issue. This is generated by extracting the local usage of
FFmpeg calling `ass_process_chunk` then fuzz with libfuzzer.
Thank you in advance for your time on clarifying our question.
--
Ticket URL: <https://trac.ffmpeg.org/ticket/11064>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker
_______________________________________________
FFmpeg-trac mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-trac
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
