#11639: libavcodec/aac/aacdec.c:195:27 SEGV in frame_configure_elements
----------------------------------+----------------------------------
Reporter: sigdevel | Type: defect
Status: new | Priority: normal
Component: ffmpeg | Version: 7.1
Keywords: SIGSEGV | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
----------------------------------+----------------------------------
Summary of the bug:
Crafted MP4 file containing invalid metadata (negative time scales in
mvhd/mdhd atoms, excessive sample size of 4294966935 and zero-duration
smples) triggers a SEGV in the AAC decoder during USAC initialization,
where frame_configure_elements attempts a WRITE memory access at address
0x70 due to an uninitialized/invalid Channel element pointer when
processing the malformed audio configuration
How to reproduce:
{{{
./ffmpeg -i ./2_poc_libavcodec_aac_aacdec_c_195 -f null
}}}
ENV:
{{{
ffmpeg OS version: 7.1.1-1+b1 ;
ffmpeg debug version: N-119918-gee1f79b0fa (ffmpeg commit hash
ee1f79b0fa4c82da9c19328b049b593c71611402) ;
built on: 6.12.25-amd64 ;
build opts debug: --disable-shared --enable-static --disable-doc --enable-
gpl --enable-libass --enable-libfreetype --enable-libmp3lame --enable-
libopus --enable-libvorbis --enable-libx264 --enable-libx265 --enable-
nonfree --toolchain=clang-asan --enable-debug=3 --disable-optimizations
--disable-stripping ;
}}}
Asan output:
{{{
== ffmpeg version N-119886-g52441bd4cd Copyright (c) 2000-2025 the FFmpeg
developers
built with Debian clang version 19.1.7 (1+b1)
configuration: --disable-shared --enable-static --disable-doc --enable-
gpl --enable-libass --enable-libfreetype --enable-libmp3lame --enable-
libopus --enable-libvorbis --enable-libx264 --enable-libx265 --enable-
nonfree --toolchain=clang-asan --enable-debug=3 --disable-optimizations
--disable-stripping
libavutil 60. 3.100 / 60. 3.100
libavcodec 62. 3.101 / 62. 3.101
libavformat 62. 1.100 / 62. 1.100
libavdevice 62. 0.100 / 62. 0.100
libavfilter 11. 0.100 / 11. 0.100
libswscale 9. 0.100 / 9. 0.100
libswresample 6. 0.100 / 6. 0.100
Trailing option(s) found in the command: may be ignored.
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x517000000080] Invalid mvhd time scale
-956300712, defaulting to 1
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x517000000080] Invalid mdhd time scale
-1761563580, defaulting to 1
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x517000000080] Sample size 4294966935 is too
large
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x517000000080] All samples in data stream
index:id [3:4] have zero duration, stream set to be discarded by default.
Override using AVStream->discard or -discard for ffmpeg command.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==88932==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000070
(pc 0x55bcf83bbc74 bp 0x7ffd58251870 sp 0x7ffd58251770 T0)
==88932==The signal is caused by a WRITE memory access.
==88932==Hint: address points to the zero page.
#0 0x55bcf83bbc74 in frame_configure_elements /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavcodec/aac/aacdec.c:195:27
#1 0x55bcf83ba731 in ff_aac_output_configure /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavcodec/aac/aacdec.c:518:20
#2 0x55bcf83bc848 in ff_aac_get_che /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavcodec/aac/aacdec.c:632:13
#3 0x55bcf83f3ad2 in ff_aac_usac_reset_state /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavcodec/aac/aacdec_usac.c:308:15
#4 0x55bcf83f5980 in ff_aac_usac_config_decode /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavcodec/aac/aacdec_usac.c:553:11
#5 0x55bcf83c8a93 in decode_audio_specific_config_gb /media/user
/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavcodec/aac/aacdec.c:1053:20
#6 0x55bcf83bed97 in decode_audio_specific_config /media/user
/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavcodec/aac/aacdec.c:1097:12
#7 0x55bcf83be4d6 in ff_aac_decode_init /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavcodec/aac/aacdec.c:1193:20
#8 0x55bcf83e3a66 in ff_aac_decode_init_float /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavcodec/aac/aacdec_float.c:181:12
#9 0x55bcf671b34f in avcodec_open2 /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavcodec/avcodec.c:336:19
#10 0x55bcf5fea1de in avformat_find_stream_info /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavformat/demux.c:2592:21
#11 0x55bcf51527d0 in ifile_open /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/fftools/ffmpeg_demux.c:1814:15
#12 0x55bcf51b6f94 in open_files /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/fftools/ffmpeg_opt.c:1366:15
#13 0x55bcf51b69d8 in ffmpeg_parse_options /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/fftools/ffmpeg_opt.c:1415:11
#14 0x55bcf51fa099 in main /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/fftools/ffmpeg.c:991:11
#15 0x7ffa2c433ca7 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#16 0x7ffa2c433d64 in __libc_start_main csu/../csu/libc-start.c:360:3
#17 0x55bcf505b710 in _start (/media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/ffmpeg+0x521710)
(BuildId: d2246b878abfa9a260cfb4c2c78620ba94243a83)
==88932==Register values:
rax = 0x0000000000000070 rbx = 0x00007ffd58251880 rcx =
0x00000000000001f8 rdx = 0x0000000000000018
rdi = 0x0000000000000000 rsi = 0x000052d000023f10 rbp =
0x00007ffd58251870 rsp = 0x00007ffd58251770
r8 = 0x00000a32000003fc r9 = 0x0000519000001ff7 r10 =
0x00000a32000003fe r11 = 0x00000a327fff83f8
r12 = 0x0000000000000000 r13 = 0x00007ffd58255908 r14 =
0x00007ffa2e5af000 r15 = 0x000055bcf9ccb1b0
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /media/user/6d3eeb8a-
a93b-4220-bb13-a4e488ce0ce2/gpac/runtime/ffmpeg_asan/libavcodec/aac/aacdec.c:195:27
in frame_configure_elements
==88932==ABORTING
}}}
[[Image(https://github.com/sigdevel/pocs/blob/d65a0c4ece90b07878ae098f93d925c1301ce676/res/FFmpeg/ffmpeg/2/ffmpeg_2_asan_2025-06-15_17-20.png)]]
Poc-sample was uploaded to https://streams.videolan.org/upload/
--
Ticket URL: <https://trac.ffmpeg.org/ticket/11639>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker
_______________________________________________
FFmpeg-trac mailing list
FFmpeg-trac@avcodec.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-trac
To unsubscribe, visit link above, or email
ffmpeg-trac-requ...@ffmpeg.org with subject "unsubscribe".
