[FFmpeg-trac] #10950(avfilter:new): heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column in FFmpeg7.0
FFmpeg
trac at avcodec.org
Sat Apr 6 04:31:53 EEST 2024
#10950: heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column
in FFmpeg7.0
-------------------------------------+-------------------------------------
Reporter: | Type: defect
ZengYunxiang |
Status: new | Priority: important
Component: avfilter | Version: 7.0
Keywords: bugs | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
-------------------------------------+-------------------------------------
Summary of the bug:
Dear developers,
We found the following heap-buffer-overflow bug on FFmpeg(version 7.0)
when using tiltandshift filter, please confirm.
The poc file(poc22ffmpeg) will be attached to this ticket.
How to reproduce:
{{{
tar -xvf ffmpeg-7.0.tar.xz
cd ffmpeg-7.0
./configure --cc=afl-clang-fast --cxx=afl-clang-fast++ --disable-shared
AFL_USE_ASAN=1 make -j30
./ffmpeg_g -y -i poc22ffmpeg -filter_complex tiltandshift tmp.mp4
}}}
ASAN Log:
{{{
=================================================================
==2083246==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x631000013440 at pc 0x564e02fe64ca bp 0x7fa1036fbab0 sp 0x7fa1036fb280
WRITE of size 1 at 0x631000013440 thread T2 (fc0)
#0 0x564e02fe64c9 in __asan_memcpy (/ffmpeg-7.0/ffmpeg_g+0x9a24c9)
(BuildId: 545ccc2062eaee7e775c86df925c8f1fb97035e3)
#1 0x564e0753d519 in image_copy_plane
/ffmpeg-7.0/libavutil/imgutils.c:353:9
#2 0x564e0753e811 in image_copy
/ffmpeg-7.0/libavutil/imgutils.c:415:13
#3 0x564e0753db54 in av_image_copy
/ffmpeg-7.0/libavutil/imgutils.c:434:5
#4 0x564e037fd38b in copy_column
/ffmpeg-7.0/libavfilter/vf_tiltandshift.c:189:5
#5 0x564e037fd38b in output_frame
/ffmpeg-7.0/libavfilter/vf_tiltandshift.c:235:13
#6 0x564e037fde7a in request_frame
/ffmpeg-7.0/libavfilter/vf_tiltandshift.c:298:19
#7 0x564e031a380b in ff_request_frame_to_filter
/ffmpeg-7.0/libavfilter/avfilter.c:520:15
#8 0x564e0319ea0b in forward_status_change
/ffmpeg-7.0/libavfilter/avfilter.c:1188:19
#9 0x564e0319ea0b in ff_filter_activate_default
/ffmpeg-7.0/libavfilter/avfilter.c:1232:20
#10 0x564e0319ea0b in ff_filter_activate
/ffmpeg-7.0/libavfilter/avfilter.c:1386:11
#11 0x564e031ba906 in push_frame
/ffmpeg-7.0/libavfilter/buffersrc.c:184:15
#12 0x564e031ba906 in av_buffersrc_close
/ffmpeg-7.0/libavfilter/buffersrc.c:284:47
#13 0x564e03050dfd in send_eof
/ffmpeg-7.0/fftools/ffmpeg_filter.c:2527:15
#14 0x564e03050dfd in filter_thread
/ffmpeg-7.0/fftools/ffmpeg_filter.c:2832:19
#15 0x564e030b27d2 in task_wrapper
/ffmpeg-7.0/fftools/ffmpeg_sched.c:2447:11
#16 0x7fa106178ac2 (/lib/x86_64-linux-gnu/libc.so.6+0x94ac2)
(BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9)
#17 0x7fa10620aa3f (/lib/x86_64-linux-gnu/libc.so.6+0x126a3f)
(BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9)
0x631000013440 is located 0 bytes to the right of 76864-byte region
[0x631000000800,0x631000013440)
allocated by thread T2 (fc0) here:
#0 0x564e02fe7c67 in __interceptor_posix_memalign
(/ffmpeg-7.0/ffmpeg_g+0x9a3c67) (BuildId:
545ccc2062eaee7e775c86df925c8f1fb97035e3)
#1 0x564e0754f9d1 in av_malloc /ffmpeg-7.0/libavutil/mem.c:105:9
#2 0x564e074e9b6c in av_buffer_alloc
/ffmpeg-7.0/libavutil/buffer.c:82:12
#3 0x564e074e9b6c in av_buffer_allocz
/ffmpeg-7.0/libavutil/buffer.c:95:24
#4 0x564e074ec5d6 in pool_alloc_buffer
/ffmpeg-7.0/libavutil/buffer.c:363:26
#5 0x564e074ec5d6 in av_buffer_pool_get
/ffmpeg-7.0/libavutil/buffer.c:401:15
#6 0x564e03201ca5 in ff_frame_pool_get
/ffmpeg-7.0/libavfilter/framepool.c:217:29
#7 0x564e0395adfe in ff_default_get_video_buffer2
/ffmpeg-7.0/libavfilter/video.c:96:13
#8 0x564e037fc33e in output_frame
/ffmpeg-7.0/libavfilter/vf_tiltandshift.c:199:20
#9 0x564e037fde7a in request_frame
/ffmpeg-7.0/libavfilter/vf_tiltandshift.c:298:19
Thread T2 (fc0) created by T0 here:
#0 0x564e02fd056c in __interceptor_pthread_create
(/ffmpeg-7.0/ffmpeg_g+0x98c56c) (BuildId:
545ccc2062eaee7e775c86df925c8f1fb97035e3)
#1 0x564e030aad23 in task_start
/ffmpeg-7.0/fftools/ffmpeg_sched.c:416:11
SUMMARY: AddressSanitizer: heap-buffer-overflow
(/ffmpeg-7.0/ffmpeg_g+0x9a24c9) (BuildId:
545ccc2062eaee7e775c86df925c8f1fb97035e3) in __asan_memcpy
Shadow bytes around the buggy address:
0x0c627fffa630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c627fffa640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c627fffa650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c627fffa660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c627fffa670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c627fffa680: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
0x0c627fffa690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627fffa6a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627fffa6b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627fffa6c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627fffa6d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2083246==ABORTING
}}}
ffmpeg version:
{{{
# ./ffmpeg -version
ffmpeg version 7.0 Copyright (c) 2000-2024 the FFmpeg developers
built with Ubuntu clang version 14.0.0-1ubuntu1.1
configuration: --cc=afl-clang-fast --cxx=afl-clang-fast++ --disable-shared
libavutil 59. 8.100 / 59. 8.100
libavcodec 61. 3.100 / 61. 3.100
libavformat 61. 1.100 / 61. 1.100
libavdevice 61. 1.100 / 61. 1.100
libavfilter 10. 1.100 / 10. 1.100
libswscale 8. 1.100 / 8. 1.100
libswresample 5. 1.100 / 5. 1.100
}}}
Credit:
{{{
Discovered by Zeng Yunxiang.
}}}
Thanks for your time!
--
Ticket URL: <https://trac.ffmpeg.org/ticket/10950>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker
More information about the FFmpeg-trac
mailing list