[FFmpeg-trac] #8323(undetermined:new): signed integer overflow at libavfilter/vf_aspect.c:81
FFmpeg
trac at avcodec.org
Tue Oct 22 10:33:09 EEST 2019
#8323: signed integer overflow at libavfilter/vf_aspect.c:81
-------------------------------------+-------------------------------------
Reporter: Suhwan | Type: defect
Status: new | Priority: normal
Component: | Version: git-
undetermined | master
Keywords: ubsan | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
-------------------------------------+-------------------------------------
Summary of the bug:
There're two signed integer overflow at libavfilter/vf_aspect.c:81
I compiled ffmpeg with "--toolchain=clang-usan" to check the undefined-
behaviours and attached log file.
How to reproduce:
{{{
% ffmpeg_g -i $PoC -filter_complex setsar -target dv -loglevel 0
tmp.vc1test
ffmpeg version N-95517-g0b8956b25c Copyright (c) 2000-2019 the FFmpeg
developers
built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug
--toolchain=clang-usan
}}}
Here's UBSAN log
{{{
libavfilter/vf_aspect.c:81:49: runtime error: signed integer overflow:
1562273630 * 17 cannot be represented in type 'int'
Thread 1 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in
__ubsan::ScopedReport::~ScopedReport() ()
(gdb) bt
#0 0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() ()
#1 0x000000000042b0eb in void
handleIntegerOverflowImpl<__ubsan::Value>(__ubsan::OverflowData*, unsigned
long, char const*, __ubsan::Value, __ubsan::ReportOptions) ()
#2 0x000000000042c9df in __ubsan_handle_mul_overflow ()
#3 0x0000000000695c1f in compute_dar (dar=0x7fffffffbff0, sar=..., w=17,
h=<optimized out>)
at libavfilter/vf_aspect.c:81
#4 0x0000000000695ddf in setsar_config_props (outlink=0x96c8f80) at
libavfilter/vf_aspect.c:215
#5 0x00000000005c60a6 in avfilter_config_links (filter=0x96c8bc0) at
libavfilter/avfilter.c:318
#6 0x00000000005c604c in avfilter_config_links (filter=0x96c9140) at
libavfilter/avfilter.c:307
#7 0x00000000005c604c in avfilter_config_links (filter=0x96c8900) at
libavfilter/avfilter.c:307
#8 0x00000000005d8a02 in graph_config_links (graph=<optimized out>,
log_ctx=<optimized out>)
at libavfilter/avfiltergraph.c:261
#9 avfilter_graph_config (graphctx=<optimized out>, log_ctx=0x0) at
libavfilter/avfiltergraph.c:1279
#10 0x000000000046a53f in configure_filtergraph (fg=<optimized out>) at
fftools/ffmpeg_filter.c:1109
#11 0x00000000004cad35 in ifilter_send_frame (ifilter=<optimized out>,
frame=<optimized out>)
at fftools/ffmpeg.c:2179
#12 send_frame_to_filters (ist=0x93cae00, decoded_frame=0x96c17c0) at
fftools/ffmpeg.c:2260
#13 0x00000000004a07dc in decode_video (ist=<optimized out>,
pkt=<optimized out>, got_output=<optimized out>,
duration_pts=<optimized out>, eof=<optimized out>,
decode_failed=<optimized out>) at fftools/ffmpeg.c:2459
#14 process_input_packet (ist=<optimized out>, pkt=<optimized out>,
no_eof=<optimized out>)
at fftools/ffmpeg.c:2613
#15 0x00000000004ba058 in process_input (file_index=0) at
fftools/ffmpeg.c:4303
#16 0x000000000048d60b in transcode_step () at fftools/ffmpeg.c:4628
#17 transcode () at fftools/ffmpeg.c:4682
#18 0x0000000000487dc4 in main (argc=10, argv=<optimized out>) at
fftools/ffmpeg.c:4884
(gdb) c
Continuing.
libavfilter/vf_aspect.c:81:62: runtime error: signed integer overflow:
1022679769 * 17 cannot be represented in type 'int'
}}}
Please confirm.
Thanks
--
Ticket URL: <https://trac.ffmpeg.org/ticket/8323>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker
More information about the FFmpeg-trac
mailing list