[FFmpeg-trac] #8293(undetermined:new): signed integer overflow at libswscale/output.c:1852

[FFmpeg]

#8293: signed integer overflow at libswscale/output.c:1852
-------------------------------------+-------------------------------------
             Reporter:  Suhwan       |                     Type:  defect
               Status:  new          |                 Priority:  normal
            Component:               |                  Version:  git-
  undetermined                       |  master
             Keywords:  ubsan        |               Blocked By:
             Blocking:               |  Reproduced by developer:  0
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------
 Summary of the bug:
 There is a signed integer overflow at libswscale/output.c:1852

 I compiled ffmpeg with "--toolchain=clang-usan" to check the undefined-
 behaviours and attached log file.
 How to reproduce:
 {{{
 % ffmpeg_g -y -i $PoC -filter_complex allyuv -loglevel 0 -map 0 tmp.afc

 ffmpeg version N-95405-g98ae6b0a4d Copyright (c) 2000-2019 the FFmpeg
 developers
 built with clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
 configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug
 --toolchain=clang-usan
 }}}

 Here's UBSAN log

 {{{
 libswscale/output.c:1852:11: runtime error: signed integer overflow:
 1169365504 + 981452800 cannot be represented in type 'int'

 Thread 1 "ffmpeg_g" hit Breakpoint 1, 0x00000000004288b0 in
 __ubsan::ScopedReport::~ScopedReport() ()
 (gdb) bt
 #0  0x00000000004288b0 in __ubsan::ScopedReport::~ScopedReport() ()
 #1  0x000000000042b0eb in void
 handleIntegerOverflowImpl<__ubsan::Value>(__ubsan::OverflowData*, unsigned
 long, char const*, __ubsan::Value, __ubsan::ReportOptions) ()
 #2  0x000000000042c8bf in __ubsan_handle_add_overflow ()
 #3  0x00000000056a35f4 in yuv2rgb_write_full (c=<optimized out>,
 Y=1169365504, A=0, U=<optimized out>, V=<optimized out>,
 target=AV_PIX_FMT_RGB24, hasAlpha=0, dest=<optimized out>,
     i=<optimized out>, y=<optimized out>, err=<optimized out>) at
 libswscale/output.c:1852
 #4  yuv2rgb_full_1_c_template (c=<optimized out>, buf0=<optimized out>,
 ubuf=<optimized out>, vbuf=<optimized out>, abuf0=<optimized out>,
 dest=<optimized out>, dstW=<optimized out>,
     uvalpha=<optimized out>, y=<optimized out>, target=AV_PIX_FMT_RGB24,
 hasAlpha=0) at libswscale/output.c:2103
 #5  yuv2rgb24_full_1_c (c=0x93f0880, buf0=<optimized out>, ubuf=<optimized
 out>, vbuf=<optimized out>, abuf0=<optimized out>, dest=<optimized out>,
 dstW=4096, uvalpha=0, y=4)
     at libswscale/output.c:2148
 #6  0x000000000554d1fc in packed_vscale (c=<optimized out>,
 desc=<optimized out>, sliceY=<optimized out>, sliceH=<optimized out>) at
 libswscale/vscale.c:128
 #7  0x0000000005516445 in swscale (c=<optimized out>, src=<optimized out>,
 srcStride=<optimized out>, srcSliceY=<optimized out>, srcSliceH=<optimized
 out>, dst=<optimized out>,
     dstStride=<optimized out>) at libswscale/swscale.c:503
 #8  0x00000000055209b2 in sws_scale (c=0x93f0880, srcSlice=0x93fa574,
 srcStride=0x7fffffffc9a0, srcSliceY=0, srcSliceH=4096, dst=<optimized
 out>, dstStride=0x7fffffffc990)
     at libswscale/swscale.c:978
 #9  0x0000000000d247ce in scale_slice (link=<optimized out>,
 out_buf=<optimized out>, cur_pic=<optimized out>, sws=<optimized out>,
 y=<optimized out>, h=<optimized out>, mul=<optimized out>,
     field=<optimized out>) at libavfilter/vf_scale.c:411
 #10 0x0000000000d2027d in scale_frame (link=<optimized out>, in=0xa19f240,
 frame_out=<optimized out>) at libavfilter/vf_scale.c:535
 #11 0x0000000000d1d7ed in filter_frame (link=0x93ed9c0, in=0xa19f240) at
 libavfilter/vf_scale.c:549
 #12 0x00000000005cfe9d in ff_filter_frame_framed (link=<optimized out>,
 frame=0x0) at libavfilter/avfilter.c:1084
 #13 ff_filter_frame_to_filter (link=<optimized out>) at
 libavfilter/avfilter.c:1232
 #14 ff_filter_activate_default (filter=<optimized out>) at
 libavfilter/avfilter.c:1281
 #15 ff_filter_activate (filter=<optimized out>) at
 libavfilter/avfilter.c:1443
 #16 0x00000000005eecd3 in get_frame_internal (ctx=0x93ed440,
 frame=<optimized out>, flags=1, samples=<optimized out>) at
 libavfilter/buffersink.c:110
 #17 0x00000000005e254b in avfilter_graph_request_oldest (graph=0x93e0b00)
 at libavfilter/avfiltergraph.c:1409
 #18 0x000000000048c3a2 in transcode_from_filter (graph=0x93ae700,
 best_ist=<optimized out>) at fftools/ffmpeg.c:4531
 #19 transcode_step () at fftools/ffmpeg.c:4606
 #20 transcode () at fftools/ffmpeg.c:4682
 #21 0x0000000000487da4 in main (argc=11, argv=<optimized out>) at
 fftools/ffmpeg.c:4884

 }}}
 Please confirm.
 Thanks

--
Ticket URL: <https://trac.ffmpeg.org/ticket/8293>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker