#11349: signed integer overflow in libavformat/icodec.c
-------------------------------------+-------------------------------------
Reporter: skorpion98 | Type: defect
Status: new | Priority: normal
Component: | Version: git-
undetermined | master
Keywords: ubsan, | Blocked By:
overflow |
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
-------------------------------------+-------------------------------------
**Summary of the bug**: Signed integer overflow in
libavformat/icodec.c:175:42
**How to reproduce**:
In the archive uploaded to the "VideoLAN File Uploader" you will find:
* the executable on which we performed our tests, a compiled version of
the `ffmpeg_DEMUXER_fuzzer` fuzzing harness you made
* a directory `bug` containing the input that caused the aforementioned
bug and its UBSan log
To reproduce the errors, simply run the given binary with the testcase
files with a command like: `./ffmpeg_DEMUXER_fuzzer
/path_to_testcases/input`.
The program has been tested on the standard Docker image provided on OSS-
Fuzz using Ubuntu 20.04, using AFL++ as fuzzing engine and the standard
sanitizers flags used by OSS-Fuzz for ASan and UBSan.
The hash commit used to perform the tests is `eb79c31`.
**UBSan output**:
{{{
Reading 51 bytes from /bugs/ffmpeg/signed_integer_overflow_avformat_03
libavformat/icodec.c:175:42: runtime error: signed integer overflow: 14 +
2147483647 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
libavformat/icodec.c:175:42
}}}
--
Ticket URL: <https://trac.ffmpeg.org/ticket/11349>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker
_______________________________________________
FFmpeg-trac mailing list
FFmpeg-trac@avcodec.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-trac
To unsubscribe, visit link above, or email
ffmpeg-trac-requ...@ffmpeg.org with subject "unsubscribe".
