[FFmpeg-devel] AAC AVERROR_BUG

[Michael Niedermayer]

Hi Lynne, ffmpeg-devel

the following (testcase public, not cattegorized as a security issue)
https://issues.oss-fuzz.com/issues/416134551

hits
            if (!ics->num_swb || !ics->swb_offset) {
                ret_fail = AVERROR_BUG;
                goto fail;
            }

Assertion ret != (-(int)(('B') | (('U') << 8) | (('G') << 16) | ((unsigned)('!') << 24))) failed at tools/target_dec_fuzzer.c:556
MemorySanitizer:DEADLYSIGNAL
==399==ERROR: MemorySanitizer: ABRT on unknown address 0x05390000018f (pc 0x7d47828ed00b bp 0x7ffc5e5cb040 sp 0x7ffc5e5cac70 T399)
    #0 0x7d47828ed00b in raise /build/glibc-LcI20x/glibc-2.31/sysdeps/unix/sysv/linux/raise.c:51:1
    #1 0x7d47828cc858 in abort /build/glibc-LcI20x/glibc-2.31/stdlib/abort.c:79:7
    #2 0x586ab3406fdc in LLVMFuzzerTestOneInput ffmpeg/tools/target_dec_fuzzer.c:0
    #3 0x586ab32f7fe0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #4 0x586ab32e3255 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #5 0x586ab32e8cef in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #6 0x586ab3313f92 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #7 0x7d47828ce082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
    #8 0x586ab32db43d in _start


thx
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Any man who breaks a law that conscience tells him is unjust and willingly 
accepts the penalty by staying in jail in order to arouse the conscience of 
the community on the injustice of the law is at that moment expressing the 
very highest respect for law. - Martin Luther King Jr
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20250817/d19eeba2/attachment.sig>