Skip to content

oss-fuzz: integer overflow in warp_affine()

Integer overflow detected only know due to allowing larger frame sizes in fuzzing.

clusterfuzz-testcase-minimized-dav1d_fuzzer_mt-5736621216890880

 	../../src/dav1d/src/recon_tmpl.c:786:54: runtime error: signed integer overflow: 65524 * 65348 cannot be represented in type 'int'
	    #0 0x58cd72 in warp_affine /src/dav1d/src/recon_tmpl.c:786:54
	    #1 0x5877c1 in dav1d_recon_b_inter_16bpc /src/dav1d/src/recon_tmpl.c:1271:19
	    #2 0x4e24f4 in decode_b /src/dav1d/src/decode.c:1859:17
	    #3 0x4d20b8 in decode_sb /src/dav1d/src/decode.c:2248:17
	    #4 0x4d136d in dav1d_decode_tile_sbrow /src/dav1d/src/decode.c:2557:13
	    #5 0x4cd2f7 in dav1d_tile_task /src/dav1d/src/thread_task.c:95:29
	    #6 0x7ff0337736b9 in start_thread
	    #7 0x7ff032b7e41c in clone /build/glibc-LK5gWL/glibc-2.23/sysdeps/unix/sysv/linux/x86_64/clone.S:109
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information