[FFmpeg-trac] #8350(undetermined:new): signed integer overflow at libavcodec/put_bits.h:56

[FFmpeg]

#8350: signed integer overflow at libavcodec/put_bits.h:56
-------------------------------------+-------------------------------------
             Reporter:  Suhwan       |                     Type:  defect
               Status:  new          |                 Priority:  normal
            Component:               |                  Version:  git-
  undetermined                       |  master
             Keywords:               |               Blocked By:
             Blocking:               |  Reproduced by developer:  0
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------
 Summary of the bug:
 There is a signed integer overflow at libavcodec/put_bits.h:56

 I compiled ffmpeg with "--toolchain=clang-usan" to check the undefined-
 behaviours and attached log file.
 How to reproduce:
 {{{
 % ffmpeg_g -y -r 62 -i $PoC -loglevel 0 -vbsf mov2textsub -c ffv1
 tmp.mjpeg

 ffmpeg version N-95604-g881f083a16 Copyright (c) 2000-2019 the FFmpeg
 developers
 built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
 configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug
 --toolchain=clang-usan
 }}}

 Here's UBSAN log

 {{{
 libavcodec/put_bits.h:56:25: runtime error: signed integer overflow: 8 *
 296117757 cannot be represented in type 'int'

 Thread 1 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in
 __ubsan::ScopedReport::~ScopedReport() ()
 (gdb) bt
 #0  0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() ()
 #1  0x000000000042b0eb in void
 handleIntegerOverflowImpl<__ubsan::Value>(__ubsan::OverflowData*, unsigned
 long, char const*, __ubsan::Value, __ubsan::ReportOptions) ()
 #2  0x000000000042c9df in __ubsan_handle_mul_overflow ()
 #3  0x00000000020c93f7 in init_put_bits (s=<optimized out>,
 buffer=0x7fff7dfe3043 "", buffer_size=296117757) at
 libavcodec/put_bits.h:56
 #4  encode_slice (c=0x9416480, arg=<optimized out>) at
 libavcodec/ffv1enc.c:1078
 #5  0x0000000002ed372a in worker_func (priv=0x9416480, jobnr=0,
 threadnr=<optimized out>, nb_jobs=<optimized out>, nb_threads=<optimized
 out>)
     at libavcodec/pthread_slice.c:71
 #6  0x0000000005a0d108 in run_jobs (ctx=0x976cc40) at
 libavutil/slicethread.c:61
 #7  0x0000000005a0cdbf in avpriv_slicethread_execute (ctx=<optimized out>,
 nb_jobs=<optimized out>, execute_main=0) at libavutil/slicethread.c:188
 #8  0x0000000002ed2a4d in thread_execute (avctx=<optimized out>,
 func=<optimized out>, arg=<optimized out>, ret=<optimized out>,
 job_count=<optimized out>,
     job_size=<optimized out>) at libavcodec/pthread_slice.c:110
 #9  0x00000000020bf7fe in encode_frame (avctx=0x9416480, pkt=0x976c840,
 pict=0x9778040, got_packet=0x7fffffffc284) at libavcodec/ffv1enc.c:1233
 #10 0x000000000200739f in avcodec_encode_video2 (avctx=0x9416480,
 avpkt=<optimized out>, frame=<optimized out>,
 got_packet_ptr=0x7fffffffc284) at libavcodec/encode.c:302
 #11 0x00000000020090d0 in do_encode (avctx=0x9416480, frame=0x9778040,
 got_packet=0x7fffffffc284) at libavcodec/encode.c:371
 #12 0x0000000002008c4a in avcodec_send_frame (avctx=0x9416480,
 frame=0x9778040) at libavcodec/encode.c:420
 #13 0x00000000004c5228 in do_video_out (of=0x9403cc0, ost=<optimized out>,
 next_picture=<optimized out>, sync_ipts=4.9406564584124654e-324) at
 fftools/ffmpeg.c:1288
 #14 0x00000000004c0f5b in reap_filters (flush=0) at fftools/ffmpeg.c:1505
 #15 0x000000000048d6b2 in transcode_step () at fftools/ffmpeg.c:4639
 #16 transcode () at fftools/ffmpeg.c:4683
 #17 0x0000000000487dc4 in main (argc=13, argv=<optimized out>) at
 fftools/ffmpeg.c:4885

 }}}
 Please confirm.
 Thanks

--
Ticket URL: <https://trac.ffmpeg.org/ticket/8350>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker