[FFmpeg-trac] #11346(avcodec:new): signed integer overflow in libavformat/demux.c

[FFmpeg]

#11346: signed integer overflow in libavformat/demux.c
-------------------------------------+-------------------------------------
             Reporter:  skorpion98   |                     Type:  defect
               Status:  new          |                 Priority:  normal
            Component:  avcodec      |                  Version:  git-
             Keywords:  ubsan,       |  master
  overflow                           |               Blocked By:
             Blocking:               |  Reproduced by developer:  0
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------
 **Summary of the bug**: Signed integer overflow in libavformat/demux.c:804

 **How to reproduce**:
 In the attached archive you will find:
 * the executable on which we performed our tests, a compiled version of
 the `ffmpeg_DEMUXER_fuzzer` fuzzing harness you made
 * a directory `bug` containing the input that caused the aforementioned
 bug and its UBSan log

 To reproduce the errors, simply run the given binary with the testcase
 files with a command like:
 `./ffmpeg_DEMUXER_fuzzer /path_to_testcases/input`.

 The program has been tested on the standard Docker image provided on OSS-
 Fuzz using Ubuntu 20.04, using AFL++ as fuzzing engine and the standard
 sanitizers flags used by OSS-Fuzz for ASan and UBSan.

 The hash commit used to perform the tests is `eb79c31`.

 **UBSan output**:

 {{{
 Reading 8517 bytes from /bugs/ffmpeg/signed_integer_overflow_avformat_01
 libavformat/demux.c:804:36: runtime error: signed integer overflow:
 -9223371749632982144 - 1907869387765793664 cannot be represented in type
 'int64_t' (aka 'long')
 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
 libavformat/demux.c:804:36
 }}}
-- 
Ticket URL: <https://trac.ffmpeg.org/ticket/11346>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker