A Division by zero occurred in function mov_build_index () of libmpdemux/demux_mov.c

[ylzs]

Version: SVN-r38374-13.0.1

Build command: ../configure --disable-ffmpeg_a && make (compiling with asan)

Summary of the bug: An Division by zero is found in fucnction mov_build_index () which affects mplayer and mencoder. The attached file can reproduce this issue (ASAN-recompilation is needed). And this vulnerability can cause the crash of the mplayer.

How to reproduce:

1.Command: ./mencoder -ovc lavc -oac lavc -o /dev/null ./testcase

./mplayer ./testcase

2.Result:

MEncoder SVN-r38374-13.0.1 (C) 2000-2022 MPlayer Team
success: format: 0  data: 0x0 - 0x618
libavformat version 58.29.100 (external)
libavformat file format detected.
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f69da944600]Invalid mvhd time scale 0, defaulting to 1
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f69da944600]stream 0, timescale not set
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f69da944600]stream 1, contradictionary STSC and STCO
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f69da944600]error reading header
LAVF_header: av_open_input_stream() failed
ISO: File Type Major Brand: Original QuickTime
Quicktime/MOV file format detected.
*** constant samplesize & variable duration not yet supported! ***
Contact the author if you have such sample file!
MOV: durmap and chunkmap sample count differ (2 vs 0)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==29712==ERROR: AddressSanitizer: FPE on unknown address 0x5634cbb6c512 (pc 0x5634cbb6c512 bp 0x7fff11bafe20 sp 0x7fff11baf9a0 T0)
    #0 0x5634cbb6c512 in mov_build_index /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:302:66
    #1 0x5634cbb6c512 in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1333:6
    #2 0x5634cbb608ec in mov_read_header /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1961:5

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:302:66 in mov_build_index
==29712==ABORTING

MPlayer SVN-r38374-9 (C) 2000-2022 MPlayer Team

Playing /home/jlx/crashes/testcase_11.
libavformat version 58.29.100 (external)
libavformat file format detected.
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f4780883600]Invalid mvhd time scale 0, defaulting to 1
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f4780883600]stream 0, timescale not set
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f4780883600]stream 1, contradictionary STSC and STCO
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f4780883600]error reading header
LAVF_header: av_open_input_stream() failed
ISO: File Type Major Brand: Original QuickTime
Quicktime/MOV file format detected.
*** constant samplesize & variable duration not yet supported! ***
Contact the author if you have such sample file!
MOV: durmap and chunkmap sample count differ (2 vs 0)


MPlayer interrupted by signal 8 in module: demux_open
- MPlayer crashed by bad usage of CPU/FPU/RAM.
  Recompile MPlayer with --enable-debug and make a 'gdb' backtrace and
  disassembly. Details in DOCS/HTML/en/bugreports_what.html#bugreports_crash.
- MPlayer crashed. This shouldn't happen.
  It can be a bug in the MPlayer code _or_ in your drivers _or_ in your
  gcc version. If you think it's MPlayer's fault, please read
  DOCS/HTML/en/bugreports.html and follow the instructions there. We can't and
  won't help unless you provide this information when reporting a possible bug.

3. debugging with gdb

   0x0000558629f09b8a      302                 el->pts_offset=((long long)e_pts*(long long)trak->timescale)/(long long)timescale-trak->samples[sample].pts;
   LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
   ────────────────────────────────────────────────────────────[ REGISTERS ]────────────────────────────────────────────────────────────
    RAX  0x0
    RBX  0x0
    RCX  0x400
   *RDX  0x0
    RDI  0x55862a74be00 ◂— 0x40000000080
    RSI  0x2
    R8   0x400
    R9   0x1
    R10  0x1f40
    R11  0x55862a73a248 ◂— 0x0
    R12  0x0
    R13  0x80
    R14  0x55862a74be30 ◂— 0x1500000000
    R15  0x0
    RBP  0x55862a74bd20 ◂— 0x200000001
    RSP  0x7ffd2e588830 ◂— 0x301
   *RIP  0x558629f09b8a (lschunks+5994) ◂— idiv   qword ptr [rsp + 0x28]
   ─────────────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────────────
      0x558629f09b88 <lschunks+5992>    cqo
    ► 0x558629f09b8a <lschunks+5994>    idiv   qword ptr [rsp + 0x28]
       ↓
      0x558629f09b8a <lschunks+5994>    idiv   qword ptr [rsp + 0x28]
   
   
   
   
   
   
   
   ─────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]──────────────────────────────────────────────────────────────────────
   In file: /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c
      297      // find start sample
      298      for(;sample<trak->samples_size;sample++){
      299          if(pts<=trak->samples[sample].pts) break;
      300      }
      301      el->start_sample=sample;
    ► 302      el->pts_offset=((long long)e_pts*(long long)trak->timescale)/(long long)timescale-trak->samples[sample].pts;
      303      pts+=((long long)el->dur*(long long)trak->timescale)/(long long)timescale;
      304      e_pts+=el->dur;
      305      // find end sample
      306      for(;sample<trak->samples_size;sample++){
      307          if(pts<trak->samples[sample].pts) break;
   ─────────────────────────────────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────────────────────────────────
   00:0000│ rsp  0x7ffd2e588830 ◂— 0x301
   01:0008│      0x7ffd2e588838 ◂— 0x5c7
   02:0010│      0x7ffd2e588840 ◂— 0x2a5
   03:0018│      0x7ffd2e588848 ◂— 0x0
   ... ↓
   06:0030│      0x7ffd2e588860 —▸ 0x55862a7410f0 ◂— 0x1c
   07:0038│      0x7ffd2e588868 ◂— 0x55867f800000
   ───────────────────────────────────────────────────────────────────────[ BACKTRACE ]────────────────────────────────────────────────────────────────────────
    ► f 0     558629f09b8a lschunks+5994
      f 1     558629f09b8a lschunks+5994
      f 2     558629f0b881 mov_read_header+145
      f 3     558629ee5947 demux_open_stream+1015
      f 4     558629ee63e1 demux_open+753
      f 5     558629e14dcb main+4027
      f 6     7f67a70d10b3 __libc_start_main+243
   ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   

[reimar]

Fixed by r38385.