#10687: SEGV bug at /fftools/ffmpeg_enc.c in set_encoder_id in FFmpeg
-------------------------------------+-------------------------------------
Reporter: | Type: defect
ZengYunxiang |
Status: new | Priority: critical
Component: avfilter | Version: git-
| master
Keywords: bugs | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
-------------------------------------+-------------------------------------
Summary of the bug:
Dear developers, hello!
I recently proposed a new fuzzing method named fuzzyx, and found the
following SEGV bug on FFmpeg6.1, please confirm.
POC file link:
poc2ffmpeg:[https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/poc2ffmpeg]
How to reproduce:
{{{
git clone https://github.com/FFmpeg/FFmpeg.git ffmpeg6-1
cd ffmpeg6-1
git checkout 466799d
./configure --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain
=clang-asan
make -j30
./ffmpeg_g -y -i poc2ffmpeg -filter_complex sinc tmp2.mp4
}}}
ASAN Log:
{{{
AddressSanitizer:DEADLYSIGNALimes
=================================================================
==444720==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x0000004df1a2 bp 0x7fffffffc220 sp 0x7fffffffc080 T0)
==444720==The signal is caused by a READ memory access.
==444720==Hint: address points to the zero page.
#0 0x4df1a1 in set_encoder_id /ffmpeg6-1/fftools/ffmpeg_enc.c
#1 0x4df1a1 in enc_open /ffmpeg6-1/fftools/ffmpeg_enc.c:190:11
#2 0x4e2903 in enc_frame /ffmpeg6-1/fftools/ffmpeg_enc.c:855:11
#3 0x4f5784 in fg_output_frame
/ffmpeg6-1/fftools/ffmpeg_filter.c:2125:15
#4 0x4f0b2d in fg_output_step
/ffmpeg6-1/fftools/ffmpeg_filter.c:2220:11
#5 0x4f0b2d in reap_filters /ffmpeg6-1/fftools/ffmpeg_filter.c:2239:19
#6 0x4f3103 in ifilter_send_frame
/ffmpeg6-1/fftools/ffmpeg_filter.c:2410:15
#7 0x4c9149 in send_frame_to_filters
/ffmpeg6-1/fftools/ffmpeg_dec.c:153:15
#8 0x4c9149 in dec_packet /ffmpeg6-1/fftools/ffmpeg_dec.c:813:19
#9 0x538938 in process_input_packet /ffmpeg6-1/fftools/ffmpeg.c:811:15
#10 0x5368a6 in transcode /ffmpeg6-1/fftools/ffmpeg.c:1219:23
#11 0x5368a6 in main /ffmpeg6-1/fftools/ffmpeg.c:1330:11
#12 0x7ffff7c0d082 in __libc_start_main (/lib/x86_64-linux-
gnu/libc.so.6+0x24082)
#13 0x420b4d in _start (/ffmpeg6-1/ffmpeg_g+0x420b4d)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /ffmpeg6-1/fftools/ffmpeg_enc.c in
set_encoder_id
==444720==ABORTING
}}}
ffmpeg version:
{{{
ffmpeg version n6.1-3-g466799d4f5 Copyright (c) 2000-2023 the FFmpeg
developers
built with clang version 9.0.0 (https://github.com/llvm-mirror/llvm
c62b24f070c9a4bb1a76409e623042a740cac4cd)
configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug
--toolchain=clang-asan
libavutil 58. 29.100 / 58. 29.100
libavcodec 60. 31.102 / 60. 31.102
libavformat 60. 16.100 / 60. 16.100
libavdevice 60. 3.100 / 60. 3.100
libavfilter 9. 12.100 / 9. 12.100
libswscale 7. 5.100 / 7. 5.100
libswresample 4. 12.100 / 4. 12.100
}}}
Credit:
{{{
Song Jiaxuan , HUST
Zeng Yunxiang , HUST
}}}
Thanks for your time!
--
Ticket URL: <https://trac.ffmpeg.org/ticket/10687>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker_______________________________________________
FFmpeg-trac mailing list
FFmpeg-trac@avcodec.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-trac
To unsubscribe, visit link above, or email
ffmpeg-trac-requ...@ffmpeg.org with subject "unsubscribe".
