Hi Lynne, ffmpeg-devel the following (testcase public, not cattegorized as a security issue) https://issues.oss-fuzz.com/issues/416134551
hits
if (!ics->num_swb || !ics->swb_offset) {
ret_fail = AVERROR_BUG;
goto fail;
}
Assertion ret != (-(int)(('B') | (('U') << 8) | (('G') << 16) |
((unsigned)('!') << 24))) failed at tools/target_dec_fuzzer.c:556
MemorySanitizer:DEADLYSIGNAL
==399==ERROR: MemorySanitizer: ABRT on unknown address 0x05390000018f (pc
0x7d47828ed00b bp 0x7ffc5e5cb040 sp 0x7ffc5e5cac70 T399)
#0 0x7d47828ed00b in raise
/build/glibc-LcI20x/glibc-2.31/sysdeps/unix/sysv/linux/raise.c:51:1
#1 0x7d47828cc858 in abort
/build/glibc-LcI20x/glibc-2.31/stdlib/abort.c:79:7
#2 0x586ab3406fdc in LLVMFuzzerTestOneInput
ffmpeg/tools/target_dec_fuzzer.c:0
#3 0x586ab32f7fe0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*,
unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
#4 0x586ab32e3255 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*,
unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
#5 0x586ab32e8cef in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned
char const*, unsigned long))
/src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
#6 0x586ab3313f92 in main
/src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
#7 0x7d47828ce082 in __libc_start_main
/build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
#8 0x586ab32db43d in _start
thx
--
Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
Any man who breaks a law that conscience tells him is unjust and willingly
accepts the penalty by staying in jail in order to arouse the conscience of
the community on the injustice of the law is at that moment expressing the
very highest respect for law. - Martin Luther King Jr
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list [email protected] https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email [email protected] with subject "unsubscribe".
