[FFmpeg-trac] #11349(undetermined:new): signed integer overflow in libavformat/icodec.c

[FFmpeg]

#11349: signed integer overflow in libavformat/icodec.c
-------------------------------------+-------------------------------------
             Reporter:  skorpion98   |                     Type:  defect
               Status:  new          |                 Priority:  normal
            Component:               |                  Version:  git-
  undetermined                       |  master
             Keywords:  ubsan,       |               Blocked By:
  overflow                           |
             Blocking:               |  Reproduced by developer:  0
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------
 **Summary of the bug**: Signed integer overflow in
 libavformat/icodec.c:175:42

 **How to reproduce**:
 In the archive uploaded to the "VideoLAN File Uploader" you will find:
 * the executable on which we performed our tests, a compiled version of
 the `ffmpeg_DEMUXER_fuzzer` fuzzing harness you made
 * a directory `bug` containing the input that caused the aforementioned
 bug and its UBSan log

 To reproduce the errors, simply run the given binary with the testcase
 files with a command like: `./ffmpeg_DEMUXER_fuzzer
 /path_to_testcases/input`.

 The program has been tested on the standard Docker image provided on OSS-
 Fuzz using Ubuntu 20.04, using AFL++ as fuzzing engine and the standard
 sanitizers flags used by OSS-Fuzz for ASan and UBSan.

 The hash commit used to perform the tests is `eb79c31`.

 **UBSan output**:

 {{{
 Reading 51 bytes from /bugs/ffmpeg/signed_integer_overflow_avformat_03
 libavformat/icodec.c:175:42: runtime error: signed integer overflow: 14 +
 2147483647 cannot be represented in type 'int'
 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
 libavformat/icodec.c:175:42

 }}}
-- 
Ticket URL: <https://trac.ffmpeg.org/ticket/11349>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker