Skip to content
GitLab
  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • Ogg Ogg
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 9
    • Issues 9
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 2
    • Merge requests 2
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Xiph.Org
  • OggOgg
  • Issues
  • #2299
Closed
Open
Created Jan 29, 2020 by Michael Niedermayer@michaelni

Invalid shift in oggpack_read()

ossfuzz of ffmpeg - libvorbis (which uses libogg) possibly found a bug in libogg

bitwise.c:396:23: runtime error: left shift of 255 by 24 places cannot be represented in type 'int'
    #0 0x7f3378 in oggpack_read /src/ogg/src/bitwise.c:396:23
    #1 0x7cb1eb in _vorbis_unpack_info /src/vorbis/lib/info.c:212:15
    #2 0x7cb0f5 in vorbis_synthesis_headerin /src/vorbis/lib/info.c:409:16
    #3 0x4c2d82 in oggvorbis_decode_init /src/ffmpeg/libavcodec/libvorbisdec.c:108:12

The code is possibly in need of a cast to unsigned but i have not looked deeply into it. The full report and 2 testcases are at the link below (this is possible not publically accessible but i can give access to this to anyone from xiph or libogg who wants to look into it). The testcase would require ffmpeg+ossfuzz+libvorbis+libogg in a bloated docker image though sadly, so iam not sure how useful that testcase would be. For me it does not reproduce outside docker. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18710

Assignee
Assign to
Time tracking