#11347: signed integer overflow in libavformat/rpl.c
-------------------------------------+-------------------------------------
Reporter: skorpion98 | Type: defect
Status: new | Priority: normal
Component: avformat | Version: git-
Keywords: ubsan, | master
overflow | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
-------------------------------------+-------------------------------------
**Summary of the bug**: Signed integer overflow in
libavformat/rpl.c:107:19
**How to reproduce**:
In the archive uploaded to the "VideoLAN File Uploader" you will find:
* the executable on which we performed our tests, a compiled version of
the `ffmpeg_DEMUXER_fuzzer` fuzzing harness you made
* a directory `bug` containing the input that caused the aforementioned
bug and its UBSan log
To reproduce the errors, simply run the given binary with the testcase
files with a command like: `./ffmpeg_DEMUXER_fuzzer
/path_to_testcases/input`.
The program has been tested on the standard Docker image provided on OSS-
Fuzz using Ubuntu 20.04, using AFL++ as fuzzing engine and the standard
sanitizers flags used by OSS-Fuzz for ASan and UBSan.
The hash commit used to perform the tests is `eb79c31`.
**UBSan output**:
{{{
Reading 97 bytes from /bugs/ffmpeg/signed_integer_overflow_avformat_02
libavformat/rpl.c:107:19: runtime error: signed integer overflow: 10 *
-2132125468444888889 cannot be represented in type 'int64_t' (aka 'long')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
libavformat/rpl.c:107:19
}}}
--
Ticket URL: <https://trac.ffmpeg.org/ticket/11347>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker
_______________________________________________
FFmpeg-trac mailing list
FFmpeg-trac@avcodec.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-trac
To unsubscribe, visit link above, or email
ffmpeg-trac-requ...@ffmpeg.org with subject "unsubscribe".
