1230286 - FFMPEG: signed integer overflow in [@ff_h264_direct_ref_list_init]

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect)

Description

[Tyson Smith [:tsmith] (PTO)]

Found fuzzing ffmpeg commit: 259c71c199e9b4ea89bf4cb90ed0e207ddc9dff7

This is an Undefined behavior sanitizer (UBSan) runtime error.

libavcodec/h264_direct.c:140:27: runtime error: signed integer overflow: 2147483647 - -8150 cannot be represented in type 'int'

Run this command with an UBSan build:
$ ./ffmpeg -v 0 -nostats -f h264 -i test_case.264 -f null -

Comment 1

[Tyson Smith [:tsmith] (PTO)]

Attachment: test_case.264

Comment 2

[Tyson Smith [:tsmith] (PTO)]

Attachment: call_stack.txt

Comment 3

[Michael Niedermayer [:mn]]

this doesnt look security relevant

Comment 4

[Ralph Giles (:rillian)]

Should be fixed in upstream commit 77a644e6fa4aaeb2c26cfaa0e8ec3b19829b8d88.

Tyson, could you please verify?

Comment 5

[Tyson Smith [:tsmith] (PTO)]

Verified.