Skip to content

integer overflow in dec_vlc_read #220

Description

@libumem
  • Version: 0.3.0.0
  • OS: Debian 12
  • Command: ./oapv_app_dec -i ./poc_huge_dimensions.apv -m 1 -v 0

Attached is a zip with the file needed to reproduce this, assuming oapv_app_dec was built with UBSAN

UBSAN Trace

<removed>/src/oapv_vlc.c:739:24: runtime error: signed integer overflow: 1073741856 + 1073741824 cannot be represented in type 'int'
    #0 0x5a0fb5d9541b in dec_vlc_read <removed>/src/oapv_vlc.c:739:24
    #1 0x5a0fb5d94ae8 in oapvd_vlc_dc_coef <removed>/src/oapv_vlc.c:817:19
    #2 0x5a0fb5d67484 in dec_tile_comp <removed>/src/oapv.c:1513:27
    #3 0x5a0fb5d67484 in dec_tile <removed>/src/oapv.c:1586:15
    #4 0x5a0fb5d67484 in dec_thread_tile <removed>/src/oapv.c:1647:15
    #5 0x5a0fb5d63c1f in oapvd_decode <removed>/src/oapv.c:1888:19
    #6 0x5a0fb5d50132 in main <removed>/app/oapv_app_dec.c:560:15
    #7 0x7e9001644249 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #8 0x7e9001644304 in __libc_start_main csu/../csu/libc-start.c:360:3
    #9 0x5a0fb5c8e420 in _start (<removed>/build/bin/oapv_app_dec+0x51420) (BuildId: 56db50aa25683e3033552d96267c16b1450aad86)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior <removed>/src/oapv_vlc.c:739:24 in 

poc.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions