#11326: Null Pointer Dereference in iamf_read_header
/ffmpeg/libavformat/iamfdec.c:110:54
---------------------------------+--------------------------------------
Reporter: steven1 | Type: defect
Status: new | Priority: normal
Component: ffmpeg | Version: git-master
Keywords: | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
---------------------------------+--------------------------------------
Summary of the bug: a null pointer dereference problem in the latest
version of ffmpeg
How to reproduce:
{{{
% ffmpeg -y -i ./poc -c:v mpeg4 -c:a copy -f mp4 /dev/null
>> built with gcc 9 (Ubuntu 9.4.0-1ubuntu1~20.04.2)
>> configuration: --cc=gcc --cxx=g++ --extra-cflags=-g --extra-
cxxflags=-g --disable-x86asm
}}}
gdb information:
{{{
# gdb --args /fuzz/oss-ffmpeg/ffmpeg-gdb/ffmpeg_g -y -i ./poc -c:v mpeg4
-c:a copy -f mp4 /dev/null
GNU gdb (Ubuntu 9.2-0ubuntu1~20.04.2) 9.2
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /fuzz/oss-ffmpeg/ffmpeg-gdb/ffmpeg_g...
(gdb) r
Starting program: /fuzz/oss-ffmpeg/ffmpeg-gdb/ffmpeg_g -y -i
./id:000000,sig:11,src:011919,time:12549736,execs:1895023,op:havoc,rep:3
-c:v mpeg4 -c:a copy -f mp4 /dev/null
warning: Error disabling address space randomization: Operation not
permitted
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
ffmpeg version N-117939-g351fd8460a Copyright (c) 2000-2024 the FFmpeg
developers
built with gcc 9 (Ubuntu 9.4.0-1ubuntu1~20.04.2)
configuration: --cc=gcc --cxx=g++ --extra-cflags=-g --extra-cxxflags=-g
--disable-x86asm
libavutil 59. 47.101 / 59. 47.101
libavcodec 61. 26.100 / 61. 26.100
libavformat 61. 9.100 / 61. 9.100
libavdevice 61. 4.100 / 61. 4.100
libavfilter 10. 6.101 / 10. 6.101
libswscale 8. 12.100 / 8. 12.100
libswresample 5. 4.100 / 5. 4.100
[iamf @ 0x55fe4836f980] Underread in audio_element_obu. 3 bytes left at
the end
[iamf @ 0x55fe4836f980] Underread in mix_presentation_obu. 22 bytes left
at the end
Program received signal SIGSEGV, Segmentation fault.
0x000055fe3a6021e1 in iamf_read_header (s=0x55fe4836f980) at
libavformat/iamfdec.c:110
110 if (!i && !j &&
audio_element->layers[0].substream_count == 1)
(gdb) bt
#0 0x000055fe3a6021e1 in iamf_read_header (s=0x55fe4836f980) at
libavformat/iamfdec.c:110
#1 0x000055fe3a5c3d49 in avformat_open_input (ps=ps@entry=0x7ffe7510b100,
filename=filename@entry=0x7ffe7510d44b
"./id:000000,sig:11,src:011919,time:12549736,execs:1895023,op:havoc,rep:3",
fmt=fmt@entry=0x0, options=0x55fe4836f558) at libavformat/demux.h:140
#2 0x000055fe3a3006fb in ifile_open (o=o@entry=0x7ffe7510b4a0,
filename=<optimized out>, sch=sch@entry=0x55fe4836f040)
at fftools/ffmpeg_demux.c:1727
#3 0x000055fe3a317abd in open_files (inout=inout@entry=0x55fe3b11cf01
"input", sch=sch@entry=0x55fe4836f040,
open_file=0x55fe3a300010 <ifile_open>, l=<optimized out>, l=<optimized
out>) at fftools/ffmpeg_opt.c:1363
#4 0x000055fe3a319aa6 in ffmpeg_parse_options (argc=<optimized out>,
argv=<optimized out>, sch=0x55fe4836f040)
at fftools/ffmpeg_opt.c:1412
#5 0x000055fe3a2f8fe8 in main (argc=11, argv=0x7ffe7510c178) at
fftools/ffmpeg.c:974
}}}
--
Ticket URL: <https://trac.ffmpeg.org/ticket/11326>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker
_______________________________________________
FFmpeg-trac mailing list
FFmpeg-trac@avcodec.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-trac
To unsubscribe, visit link above, or email
ffmpeg-trac-requ...@ffmpeg.org with subject "unsubscribe".
