Opened 5 years ago

Closed 4 years ago

Last modified 4 years ago

#8592 closed defect (fixed)

UBSan: applying zero offset to null pointer

Reported by: andreafioraldi Owned by:
Priority: normal Component: avformat
Version: git-master Keywords: ubsan
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:

pkt->data in parse_packet() can be NULL. The len return value of av_parser_parse2 is not checked against 0 and the data += len statement is UB.

How to reproduce:

% ffmpeg -i id:000002,sig:04,src:000000,time:20508,op:MOpt_havoc,rep:128 out.mp3
ffmpeg version N-97118-gfa164bc50e Copyright (c) 2000-2020 the FFmpeg developers
  built with clang version 10.0.0 (git@github.com:andreafioraldi/ConstrainedMemorySanitizer.git 5b365c37a959d429121850f6d91ed160d4cdf76f)
  configuration: --cc=clang-10 --cxx=clang++-10
  libavutil      56. 42.102 / 56. 42.102
  libavcodec     58. 77.101 / 58. 77.101
  libavformat    58. 42.100 / 58. 42.100
  libavdevice    58.  9.103 / 58.  9.103
  libavfilter     7. 77.101 /  7. 77.101
  libswscale      5.  6.101 /  5.  6.101
  libswresample   3.  6.100 /  3.  6.100
[h263 @ 0x61b000000080] Format h263 detected only with low score of 25, misdetection possible!
libavformat/utils.c:1475:14: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavformat/utils.c:1475:14 in 
[h263 @ 0x619000000580] Bad UFEP type (2)
[h263 @ 0x619000000580] header damaged
[h263 @ 0x61b000000080] decoding for stream 0 failed
[h263 @ 0x61b000000080] Could not find codec parameters for stream 0 (Video: h263, none): unspecified size
Consider increasing the value for the 'analyzeduration' and 'probesize' options
Input #0, h263, from './id:000002,sig:04,src:000000,time:20508,op:MOpt_havoc,rep:128':
  Duration: N/A, bitrate: N/A
    Stream #0:0: Video: h263, none, 25 tbr, 1200k tbn, 25 tbc
Output #0, mp3, to 'out.mp3':
Output file #0 does not contain any stream

Attachments (1)

id:000002,sig:04,src:000000,time:20508,op:MOpt_havoc,rep:128 (476 bytes ) - added by andreafioraldi 5 years ago.

Download all attachments as: .zip

Change History (3)

comment:1 by mkver, 4 years ago

Resolution: fixed
Status: newclosed

comment:2 by Carl Eugen Hoyos, 4 years ago

Component: undeterminedavformat
Note: See TracTickets for help on using tickets.