Skip to content

[oss-fuzz 4570276774084608] Integer-overflow · ParseSubViewer1

Ref.:

demux/subtitle.c:2313:39: runtime error: signed integer overflow: 2077252342 * 3600 cannot be represented in type 'int'
    #0 0x5a8c3481c37d in ParseSubViewer1 /src/vlc/modules/demux/subtitle.c:2313:39
    #1 0x5a8c34814646 in Open /src/vlc/modules/demux/subtitle.c:667:13
    #2 0x5a8c34a970c1 in demux_Probe /src/vlc/src/input/demux.c:112:15
    #3 0x5a8c34a6ac25 in vlc_module_load /src/vlc/src/modules/modules.c:230:15
    #4 0x5a8c34a96b47 in demux_NewAdvanced /src/vlc/src/input/demux.c:196:20
    #5 0x5a8c34a964d3 in demux_New /src/vlc/src/input/demux.c:77:12
    #6 0x5a8c3475b440 in demux_process_stream /src/vlc/test/src/input/demux-run.c:300:22
    #7 0x5a8c3475b283 in LLVMFuzzerTestOneInput /src/vlc/test/vlc-demux-libfuzzer.c:63:5
    #8 0x5a8c346bd760 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #9 0x5a8c346a89d5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #10 0x5a8c346ae46f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #11 0x5a8c346d9712 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #12 0x7d5d01289082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
    #13 0x5a8c346a0bbd in _start

Sample:

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information