[FFmpeg-trac] #8320(undetermined:new): left shift of negative value at libswscale/output.c:2114

[FFmpeg]

#8320: left shift of negative value at libswscale/output.c:2114
-------------------------------------+-------------------------------------
             Reporter:  Suhwan       |                     Type:  defect
               Status:  new          |                 Priority:  normal
            Component:               |                  Version:  git-
  undetermined                       |  master
             Keywords:  ubsan        |               Blocked By:
             Blocking:               |  Reproduced by developer:  0
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------
 Summary of the bug:
 There're two left shift of negative value at libswscale/output.c

 I compiled ffmpeg with "--toolchain=clang-usan" to check the undefined-
 behaviours and attached log file.
 How to reproduce:
 {{{
 % ffmpeg_g -y -i $PoC -filter_complex despill -loglevel 0 -c jpeg2000
 tmp.scc

 ffmpeg version N-95517-g0b8956b25c Copyright (c) 2000-2019 the FFmpeg
 developers
 built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
 configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug
 --toolchain=clang-usan
 }}}

 Here's UBSAN log

 {{{
 libswscale/output.c:2114:54: runtime error: left shift of negative value
 -1536

 Thread 1 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in
 __ubsan::ScopedReport::~ScopedReport() ()
 (gdb) bt
 #0  0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() ()
 #1  0x000000000042a9a0 in
 handleShiftOutOfBoundsImpl(__ubsan::ShiftOutOfBoundsData*, unsigned long,
 unsigned long, __ubsan::ReportOptions) ()
 #2  0x000000000042cb41 in __ubsan_handle_shift_out_of_bounds ()
 #3  0x0000000005676001 in yuv2rgb_full_1_c_template (c=0x9435d80,
 buf0=<optimized out>, ubuf=<optimized out>,
     vbuf=<optimized out>, abuf0=<optimized out>, dest=<optimized out>,
 dstW=455, uvalpha=3087, y=2, target=AV_PIX_FMT_ARGB,
     hasAlpha=0) at libswscale/output.c:2114
 #4  yuv2xrgb32_full_1_c (c=0x9435d80, buf0=<optimized out>,
 ubuf=<optimized out>, vbuf=<optimized out>,
     abuf0=<optimized out>, dest=<optimized out>, dstW=455, uvalpha=3087,
 y=2) at libswscale/output.c:2148
 #5  0x000000000556297c in packed_vscale (c=<optimized out>,
 desc=<optimized out>, sliceY=<optimized out>,
     sliceH=<optimized out>) at libswscale/vscale.c:134
 #6  0x0000000005529255 in swscale (c=<optimized out>, src=<optimized out>,
 srcStride=<optimized out>,
     srcSliceY=<optimized out>, srcSliceH=<optimized out>, dst=<optimized
 out>, dstStride=<optimized out>)
     at libswscale/swscale.c:503
 #7  0x00000000055337c2 in sws_scale (c=0x9435d80, srcSlice=0x943fa74,
 srcStride=0x7fffffffc190, srcSliceY=0, srcSliceH=341,
     dst=<optimized out>, dstStride=0x7fffffffc180) at
 libswscale/swscale.c:978
 #8  0x0000000000d361ee in scale_slice (link=<optimized out>,
 out_buf=<optimized out>, cur_pic=<optimized out>,
     sws=<optimized out>, y=<optimized out>, h=<optimized out>,
 mul=<optimized out>, field=<optimized out>)
     at libavfilter/vf_scale.c:411
 #9  0x0000000000d31c9d in scale_frame (link=<optimized out>, in=0x946bf00,
 frame_out=<optimized out>)
     at libavfilter/vf_scale.c:535
 #10 0x0000000000d2f20d in filter_frame (link=0x9431040, in=0x946bf00) at
 libavfilter/vf_scale.c:549
 #11 0x00000000005d002d in ff_filter_frame_framed (link=<optimized out>,
 frame=0x0) at libavfilter/avfilter.c:1084
 #12 ff_filter_frame_to_filter (link=<optimized out>) at
 libavfilter/avfilter.c:1232
 #13 ff_filter_activate_default (filter=<optimized out>) at
 libavfilter/avfilter.c:1281
 #14 ff_filter_activate (filter=<optimized out>) at
 libavfilter/avfilter.c:1443
 #15 0x00000000005f4435 in push_frame (graph=0x93e2040) at
 libavfilter/buffersrc.c:187
 #16 av_buffersrc_add_frame_internal (ctx=<optimized out>, frame=0x93d0200,
 flags=<optimized out>)
     at libavfilter/buffersrc.c:261
 #17 0x00000000005f300e in av_buffersrc_add_frame_flags (ctx=0x94302c0,
 frame=0x93d0200, flags=4)
     at libavfilter/buffersrc.c:170
 #18 0x00000000004cad80 in ifilter_send_frame (ifilter=<optimized out>,
 frame=<optimized out>) at fftools/ffmpeg.c:2186
 #19 send_frame_to_filters (ist=0x93cad80, decoded_frame=0x93d0200) at
 fftools/ffmpeg.c:2260
 #20 0x00000000004a07dc in decode_video (ist=<optimized out>,
 pkt=<optimized out>, got_output=<optimized out>,
     duration_pts=<optimized out>, eof=<optimized out>,
 decode_failed=<optimized out>) at fftools/ffmpeg.c:2459
 #21 process_input_packet (ist=<optimized out>, pkt=<optimized out>,
 no_eof=<optimized out>) at fftools/ffmpeg.c:2613
 #22 0x00000000004bf110 in process_input (file_index=<optimized out>) at
 fftools/ffmpeg.c:4508
 #23 0x000000000048d60b in transcode_step () at fftools/ffmpeg.c:4628
 #24 transcode () at fftools/ffmpeg.c:4682
 #25 0x0000000000487dc4 in main (argc=11, argv=<optimized out>) at
 fftools/ffmpeg.c:4884
 (gdb) c
 Continuing.
 libswscale/output.c:2115:54: runtime error: left shift of negative value
 -89

 Thread 1 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in
 __ubsan::ScopedReport::~ScopedReport() ()
 (gdb) q

 }}}
 Please confirm.
 Thanks

--
Ticket URL: <https://trac.ffmpeg.org/ticket/8320>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker