Skip to content

passing zero to __builtin_clz() #885

Description

@Akilan-Sivakumar

BB Issue #1032
Original issue created by farindk (bitbucket username :Dirk Farin).
Created on Bitbucket: 2026-05-03
Last updated on Bitbucket: 2026-05-04

We got the following OSS-Fuzz report, indicating an undefined behavior in x265:

Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c -n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_libheif_8acad7d454c394a82b46ab1851e1bcf3f3561254/revisions/encoder_fuzzer -rss_limit_mb=2560 -timeout=60 -runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-f978831955a96bc7982ff4c885360cd37d1b7904
Time ran: 0.25948143005371094

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 107110384
INFO: Loaded 1 modules   (815934 inline 8-bit counters): 815934 [0x555658a13e40, 0x555658adb17e),
INFO: Loaded 1 PC tables (815934 PCs): 815934 [0x555658adb180,0x55565974e560),
/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_libheif_8acad7d454c394a82b46ab1851e1bcf3f3561254/revisions/encoder_fuzzer: Running 1 inputs 100 time(s) each.
Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-f978831955a96bc7982ff4c885360cd37d1b7904
/work/x265/source/encoder/frameencoder.cpp:201:9: runtime error: passing zero to __builtin_clz(), which is not a valid argument
    #0 0x555655d88152 in x265::FrameEncoder::init(x265::Encoder*, int, int) /work/x265/source/encoder/frameencoder.cpp:201:9
    #1 0x555655c34865 in x265::Encoder::create() /work/x265/source/encoder/encoder.cpp:504:33
    #2 0x555655ad8746 in x265_encoder_open_216 /work/x265/source/encoder/api.cpp:195:14
    #3 0x555655a98364 in x265_start_sequence_encoding_intern(void*, heif_image const*, heif_image_input_class, unsigned int, unsigned int, heif_sequence_encoding_options const*, bool) libheif/libheif/plugins/encoder_x265.cc:1033:22
    #4 0x555655a945c0 in x265_encode_image(void*, heif_image const*, heif_image_input_class) libheif/libheif/plugins/encoder_x265.cc:1190:9
    #5 0x5556559c8c0a in Encoder_HEVC::encode(std::__1::shared_ptr<HeifPixelImage> const&, heif_encoder*, heif_encoding_options const&, heif_image_input_class) libheif/libheif/codecs/hevc_enc.cc:45:20
    #6 0x555655697518 in ImageItem::encode(std::__1::shared_ptr<HeifPixelImage> const&, heif_encoder*, heif_encoding_options const&, heif_image_input_class) libheif/libheif/image-items/image_item.cc:549:19
    #7 0x55565568eb10 in ImageItem::encode_to_bitstream_and_boxes(std::__1::shared_ptr<HeifPixelImage> const&, heif_encoder*, heif_encoding_options const&, heif_image_input_class) libheif/libheif/image-items/image_item.cc:251:50
    #8 0x555655692f93 in ImageItem::encode_to_item(HeifContext*, std::__1::shared_ptr<HeifPixelImage> const&, heif_encoder*, heif_encoding_options const&, heif_image_input_class) libheif/libheif/image-items/image_item.cc:388:50
    #9 0x5556558f571e in HeifContext::encode_image(std::__1::shared_ptr<HeifPixelImage> const&, heif_encoder*, heif_encoding_options const&, heif_image_input_class) libheif/libheif/context.cc:1614:34
    #10 0x55565567b324 in heif_context_encode_image libheif/libheif/api/libheif/heif_encoding.cc:711:39
    #11 0x55565566e8ca in LLVMFuzzerTestOneInput libheif/fuzzing/encoder_fuzzer.cc:195:9
    #12 0x5556555c59cd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #13 0x5556555b0742 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    #14 0x5556555b6610 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
    #15 0x5556555e2142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #16 0x7c1b229ac082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
    #17 0x5556555a982d in _start

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /work/x265/source/encoder/frameencoder.cpp:201:9

OSS-Fuzz link (may not yet be public): https://oss-fuzz.com/testcase-detail/6703023882829824

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions