[FFmpeg-trac] #11326(ffmpeg:new): Null Pointer Dereference in iamf_read_header /ffmpeg/libavformat/iamfdec.c:110:54

[FFmpeg]

#11326: Null Pointer Dereference in iamf_read_header
/ffmpeg/libavformat/iamfdec.c:110:54
---------------------------------+--------------------------------------
             Reporter:  steven1  |                     Type:  defect
               Status:  new      |                 Priority:  normal
            Component:  ffmpeg   |                  Version:  git-master
             Keywords:           |               Blocked By:
             Blocking:           |  Reproduced by developer:  0
Analyzed by developer:  0        |
---------------------------------+--------------------------------------
 Summary of the bug: a null pointer dereference problem in the latest
 version of ffmpeg
 How to reproduce:
 {{{
 % ffmpeg -y -i ./poc -c:v mpeg4 -c:a copy -f mp4 /dev/null

 >>   built with gcc 9 (Ubuntu 9.4.0-1ubuntu1~20.04.2)
 >>   configuration: --cc=gcc --cxx=g++ --extra-cflags=-g --extra-
 cxxflags=-g --disable-x86asm
 }}}
 gdb information:
 {{{
 # gdb --args /fuzz/oss-ffmpeg/ffmpeg-gdb/ffmpeg_g -y -i ./poc -c:v mpeg4
 -c:a copy -f mp4 /dev/null
 GNU gdb (Ubuntu 9.2-0ubuntu1~20.04.2) 9.2
 Copyright (C) 2020 Free Software Foundation, Inc.
 License GPLv3+: GNU GPL version 3 or later
 <http://gnu.org/licenses/gpl.html>
 This is free software: you are free to change and redistribute it.
 There is NO WARRANTY, to the extent permitted by law.
 Type "show copying" and "show warranty" for details.
 This GDB was configured as "x86_64-linux-gnu".
 Type "show configuration" for configuration details.
 For bug reporting instructions, please see:
 <http://www.gnu.org/software/gdb/bugs/>.
 Find the GDB manual and other documentation resources online at:
     <http://www.gnu.org/software/gdb/documentation/>.

 For help, type "help".
 Type "apropos word" to search for commands related to "word"...
 Reading symbols from /fuzz/oss-ffmpeg/ffmpeg-gdb/ffmpeg_g...
 (gdb) r
 Starting program: /fuzz/oss-ffmpeg/ffmpeg-gdb/ffmpeg_g -y -i
 ./id:000000,sig:11,src:011919,time:12549736,execs:1895023,op:havoc,rep:3
 -c:v mpeg4 -c:a copy -f mp4 /dev/null
 warning: Error disabling address space randomization: Operation not
 permitted
 [Thread debugging using libthread_db enabled]
 Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
 ffmpeg version N-117939-g351fd8460a Copyright (c) 2000-2024 the FFmpeg
 developers
   built with gcc 9 (Ubuntu 9.4.0-1ubuntu1~20.04.2)
   configuration: --cc=gcc --cxx=g++ --extra-cflags=-g --extra-cxxflags=-g
 --disable-x86asm
   libavutil      59. 47.101 / 59. 47.101
   libavcodec     61. 26.100 / 61. 26.100
   libavformat    61.  9.100 / 61.  9.100
   libavdevice    61.  4.100 / 61.  4.100
   libavfilter    10.  6.101 / 10.  6.101
   libswscale      8. 12.100 /  8. 12.100
   libswresample   5.  4.100 /  5.  4.100
 [iamf @ 0x55fe4836f980] Underread in audio_element_obu. 3 bytes left at
 the end
 [iamf @ 0x55fe4836f980] Underread in mix_presentation_obu. 22 bytes left
 at the end

 Program received signal SIGSEGV, Segmentation fault.
 0x000055fe3a6021e1 in iamf_read_header (s=0x55fe4836f980) at
 libavformat/iamfdec.c:110
 110                 if (!i && !j &&
 audio_element->layers[0].substream_count == 1)
 (gdb) bt
 #0  0x000055fe3a6021e1 in iamf_read_header (s=0x55fe4836f980) at
 libavformat/iamfdec.c:110
 #1  0x000055fe3a5c3d49 in avformat_open_input (ps=ps at entry=0x7ffe7510b100,
     filename=filename at entry=0x7ffe7510d44b
 "./id:000000,sig:11,src:011919,time:12549736,execs:1895023,op:havoc,rep:3",
     fmt=fmt at entry=0x0, options=0x55fe4836f558) at libavformat/demux.h:140
 #2  0x000055fe3a3006fb in ifile_open (o=o at entry=0x7ffe7510b4a0,
 filename=<optimized out>, sch=sch at entry=0x55fe4836f040)
     at fftools/ffmpeg_demux.c:1727
 #3  0x000055fe3a317abd in open_files (inout=inout at entry=0x55fe3b11cf01
 "input", sch=sch at entry=0x55fe4836f040,
     open_file=0x55fe3a300010 <ifile_open>, l=<optimized out>, l=<optimized
 out>) at fftools/ffmpeg_opt.c:1363
 #4  0x000055fe3a319aa6 in ffmpeg_parse_options (argc=<optimized out>,
 argv=<optimized out>, sch=0x55fe4836f040)
     at fftools/ffmpeg_opt.c:1412
 #5  0x000055fe3a2f8fe8 in main (argc=11, argv=0x7ffe7510c178) at
 fftools/ffmpeg.c:974
 }}}
-- 
Ticket URL: <https://trac.ffmpeg.org/ticket/11326>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker