1230423 - FFMPEG: signed integer overflow in [@implicit_weight_table]

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: call_stack.txt

Found fuzzing ffmpeg commit: 259c71c199e9b4ea89bf4cb90ed0e207ddc9dff7

This is an Undefined behavior sanitizer (UBSan) runtime error.

Looks like there are two in this function:
libavcodec/h264_slice.c:786:36: runtime error: signed integer overflow: 2147483647 + 65545 cannot be represented in type 'int'

libavcodec/h264_slice.c:812:46: runtime error: signed integer overflow: -8 - 2147483647 cannot be represented in type 'int'

Run this command with an UBSan build:
$ ./ffmpeg -v 0 -nostats -f h264 -i test_case.264 -f null -

Comment 1

[Tyson Smith [:tsmith]]

Attachment: test_case.264

Comment 2

[Ralph Giles (:rillian)]

Michael, did you see this one?

Comment 3

[Ralph Giles (:rillian)]

Assigning to Gerald to make sure this gets followed-up.

Comment 4

[Michael Niedermayer [:mn]]

seems i missed or forgot about this one
Should be fixed 7cc01c25727a96eaaa0c177234b626e47c8ea491
does not look security relevant

Comment 5

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

As per comment 4, fixed in https://github.com/FFmpeg/FFmpeg/commit/7cc01c25727a96eaaa0c177234b626e47c8ea491