#8592 closed defect (fixed)
UBSan: applying zero offset to null pointer
Reported by: | andreafioraldi | Owned by: | |
---|---|---|---|
Priority: | normal | Component: | avformat |
Version: | git-master | Keywords: | ubsan |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | no | |
Analyzed by developer: | no |
Description
Summary of the bug:
pkt->data in parse_packet() can be NULL. The len return value of av_parser_parse2 is not checked against 0 and the data += len
statement is UB.
How to reproduce:
% ffmpeg -i id:000002,sig:04,src:000000,time:20508,op:MOpt_havoc,rep:128 out.mp3 ffmpeg version N-97118-gfa164bc50e Copyright (c) 2000-2020 the FFmpeg developers built with clang version 10.0.0 (git@github.com:andreafioraldi/ConstrainedMemorySanitizer.git 5b365c37a959d429121850f6d91ed160d4cdf76f) configuration: --cc=clang-10 --cxx=clang++-10 libavutil 56. 42.102 / 56. 42.102 libavcodec 58. 77.101 / 58. 77.101 libavformat 58. 42.100 / 58. 42.100 libavdevice 58. 9.103 / 58. 9.103 libavfilter 7. 77.101 / 7. 77.101 libswscale 5. 6.101 / 5. 6.101 libswresample 3. 6.100 / 3. 6.100 [h263 @ 0x61b000000080] Format h263 detected only with low score of 25, misdetection possible! libavformat/utils.c:1475:14: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavformat/utils.c:1475:14 in [h263 @ 0x619000000580] Bad UFEP type (2) [h263 @ 0x619000000580] header damaged [h263 @ 0x61b000000080] decoding for stream 0 failed [h263 @ 0x61b000000080] Could not find codec parameters for stream 0 (Video: h263, none): unspecified size Consider increasing the value for the 'analyzeduration' and 'probesize' options Input #0, h263, from './id:000002,sig:04,src:000000,time:20508,op:MOpt_havoc,rep:128': Duration: N/A, bitrate: N/A Stream #0:0: Video: h263, none, 25 tbr, 1200k tbn, 25 tbc Output #0, mp3, to 'out.mp3': Output file #0 does not contain any stream
Attachments (1)
Change History (3)
by , 5 years ago
Attachment: | id:000002,sig:04,src:000000,time:20508,op:MOpt_havoc,rep:128 added |
---|
comment:1 by , 4 years ago
Resolution: | → fixed |
---|---|
Status: | new → closed |
comment:2 by , 4 years ago
Component: | undetermined → avformat |
---|
Note:
See TracTickets
for help on using tickets.
Fixed in 9c0b3eddf4262f9dcea479091f1307444e614e88.