Skip to content

[oss-fuzz 6290126878867456] integer overflow in video_format_IsSimilar()

This looks like overflow in the multiplication of SAR values, from an MP4 source.

Ref.:

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2751519664
INFO: Loaded 1 modules   (96258 inline 8-bit counters): 96258 [0x59dbc8f0f578, 0x59dbc8f26d7a),
INFO: Loaded 1 PC tables (96258 PCs): 96258 [0x59dbc8f26d80,0x59dbc909eda0),
/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_vlc_ec7da601ad4ba2548e708a6a10d97e34bc915675/revisions/vlc-demux-dec-libfuzzer-mp4: Running 1 inputs 100 time(s) each.
Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-d69c26346b91ec7ca9ca4337d342f92d05f8b3a5
misc/es_format.c:229:32: runtime error: signed integer overflow: 4293125120 * 4294959072 cannot be represented in type 'int64_t' (aka 'long')
    #0 0x59dbc8bde946 in video_format_IsSimilar /src/vlc/src/misc/es_format.c:229:32
    #1 0x59dbc8bde946 in es_format_IsSimilar /src/vlc/src/misc/es_format.c:461:16
    #2 0x59dbc88347e9 in test_decoder_process /src/vlc/test/src/input/decoder.c:222:14
    #3 0x59dbc88336c5 in EsOutSend /src/vlc/test/src/input/demux-run.c:115:9
    #4 0x59dbc8895d46 in es_out_Send /src/vlc/include/vlc_es_out.h:157:12
    #5 0x59dbc8895d46 in MP4_Block_Send /src/vlc/modules/demux/mp4/mp4.c:975:9
    #6 0x59dbc888f6f4 in DemuxTrack /src/vlc/modules/demux/mp4/mp4.c:1708:13
    #7 0x59dbc888f6f4 in DemuxMoov /src/vlc/modules/demux/mp4/mp4.c:1830:25
    #8 0x59dbc8885bd3 in Demux /src/vlc/modules/demux/mp4/mp4.c:1859:20
    #9 0x59dbc8832d4c in demux_process_stream /src/vlc/test/src/input/demux-run.c:312:19
    #10 0x59dbc8832b5f in LLVMFuzzerTestOneInput /src/vlc/test/vlc-demux-libfuzzer.c:63:5
    #11 0x59dbc8789ddd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #12 0x59dbc8774b52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    #13 0x59dbc877aa20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
    #14 0x59dbc87a6552 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #15 0x79f28a598082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
    #16 0x59dbc876dc3d in _start

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior misc/es_format.c:229:32

Sample:

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information