Skip to content

Undefined Behaviour in the library in multiple places

libogg/1.3.5/source/common/bitwise.c:396 Left shift of 224 by 24 places cannot be represented in type 'int'
Invalid shift base
#0	0x00000001115e574b in oggpack_read at libogg/1.3.5/source/common/bitwise.c:396
#1	0x000000011149708b in vorbis_staticbook_unpack at libvorbis/1.3.7/source/common/codebook.c:232
#2	0x00000001114db0d3 in _vorbis_unpack_books at libvorbis/1.3.7/source/common/info.c:283
#3	0x00000001114d8cdb in vorbis_synthesis_headerin at libvorbis/1.3.7/source/common/info.c:437
#4	0x00000001115d1517 in _fetch_headers at libvorbis/1.3.7/source/common/vorbisfile.c:377
#5	0x00000001115b43bb in _ov_open1 at libvorbis/1.3.7/source/common/vorbisfile.c:916
#6	0x00000001115b81b7 in ov_test_callbacks at libvorbis/1.3.7/source/common/vorbisfile.c:1069
...


libogg/1.3.5/source/common/bitwise.c:398 Left shift of 112 by 25 places cannot be represented in type 'int'
Invalid shift base
#0	0x00000001115e5acb in oggpack_read at libogg/1.3.5/source/common/bitwise.c:398
#1	0x000000011149708b in vorbis_staticbook_unpack at libvorbis/1.3.7/source/common/codebook.c:232
#2	0x00000001114db0d3 in _vorbis_unpack_books at libvorbis/1.3.7/source/common/info.c:283
#3	0x00000001114d8cdb in vorbis_synthesis_headerin at libvorbis/1.3.7/source/common/info.c:437
#4	0x00000001115d1517 in _fetch_headers at libvorbis/1.3.7/source/common/vorbisfile.c:377
#5	0x00000001115b43bb in _ov_open1 at libvorbis/1.3.7/source/common/vorbisfile.c:916
#6	0x00000001115b81b7 in ov_test_callbacks at libvorbis/1.3.7/source/common/vorbisfile.c:1069
...


libogg/1.3.5/source/common/framing.c:642 Applying zero offset to null pointer
Nullptr with offset
#0	0x00000001115f7ccf in ogg_sync_pageseek at libogg/1.3.5/source/common/framing.c:642
#1	0x00000001115bf8d3 in _get_next_page at libvorbis/1.3.7/source/common/vorbisfile.c:117
#2	0x00000001115d0aab in _fetch_headers at libvorbis/1.3.7/source/common/vorbisfile.c:293
#3	0x00000001115b43bb in _ov_open1 at libvorbis/1.3.7/source/common/vorbisfile.c:916
#4	0x00000001115b81b7 in ov_test_callbacks at libvorbis/1.3.7/source/common/vorbisfile.c:1069
...

Found these just by running an application using libogg and libvorbis with UBSAN enabled.