[FFmpeg-trac] #5130(avcodec:new): left shift of negative value in mc_chroma_unscaled()

[FFmpeg]

#5130: left shift of negative value in mc_chroma_unscaled()
---------------------------------+--------------------------------------
             Reporter:  tsmith   |                     Type:  defect
               Status:  new      |                 Priority:  normal
            Component:  avcodec  |                  Version:  git-master
             Keywords:           |               Blocked By:
             Blocking:           |  Reproduced by developer:  0
Analyzed by developer:  0        |
---------------------------------+--------------------------------------
 Summary of the bug:
 UBSan: libavcodec/vp9.c:2758:44: runtime error: left shift of negative
 value -23

 How to reproduce:
 {{{
 % ffmpeg -f ivf -i <test_case> -f null -
 ffmpeg version N-77718-g72673ad Copyright (c) 2000-2016 the FFmpeg
 developers
   built with Ubuntu clang version 3.7.1-svn253742-1~exp1
 (branches/release_37) (based on LLVM 3.7.1)
   configuration: --cc=clang --cxx=clang++ --disable-libxcb --disable-xlib
 --disable-logging --disable-ffprobe --disable-ffplay --disable-sdl
 --disable-ffserver --disable-doc --disable-pthreads --disable-network
 --disable-d3d11va --disable-dxva2 --disable-vaapi --disable-vda --disable-
 vdpau --disable-stripping --disable-runtime-cpudetect --disable-
 securetransport --disable-iconv
   libavutil      55. 12.100 / 55. 12.100
   libavcodec     57. 22.100 / 57. 22.100
   libavformat    57. 21.101 / 57. 21.101
   libavdevice    57.  0.100 / 57.  0.100
   libavfilter     6. 23.100 /  6. 23.100
   libswscale      4.  0.100 /  4.  0.100
   libswresample   2.  0.101 /  2.  0.101
 [vp9 @ 0x619000005a80] Warning: not compiled with thread support, using
 thread emulation
 Input #0, ivf, from
 '/home/user/Desktop/vpx/corpus/bb6b5274722c3805b0dc5a19d48291090d050f1f':
   Duration: 00:18:12.33, bitrate: N/A
     Stream #0:0: Video: vp9 (Profile 0) (VP90 / 0x30395056), yuv420p(tv),
 320x240, 30 tbr, 30 tbn, 30 tbc
 [wrapped_avframe @ 0x619000003780] Warning: not compiled with thread
 support, using thread emulation
 [vp9 @ 0x619000004180] Warning: not compiled with thread support, using
 thread emulation
 Output #0, null, to 'pipe:':
   Metadata:
     encoder         : Lavf57.21.101
     Stream #0:0: Video: wrapped_avframe, yuv420p, 320x240, q=2-31, 200
 kb/s, 30 fps, 30 tbn, 30 tbc
     Metadata:
       encoder         : Lavc57.22.100 wrapped_avframe
 Stream mapping:
   Stream #0:0 -> #0:0 (vp9 (native) -> wrapped_avframe (native))
 Press [q] to stop, [?] for help
 libavcodec/vp9.c:2758:44: runtime error: left shift of negative value -23
     #0 0x1e09c53 in mc_chroma_unscaled
 /home/user/code/ffmpeg/libavcodec/vp9.c:2769:34
     #1 0x1e09c53 in inter_pred_8bpp
 /home/user/code/ffmpeg/libavcodec/vp9_mc_template.c:427
     #2 0x1ca28a7 in inter_recon
 /home/user/code/ffmpeg/libavcodec/vp9.c:2986:13
     #3 0x1ca28a7 in inter_recon_8bpp
 /home/user/code/ffmpeg/libavcodec/vp9.c:3040
     #4 0x1ca28a7 in decode_b /home/user/code/ffmpeg/libavcodec/vp9.c:3294
     #5 0x1c901e5 in decode_sb
 /home/user/code/ffmpeg/libavcodec/vp9.c:3392:17
     #6 0x1c75f55 in vp9_decode_frame
 /home/user/code/ffmpeg/libavcodec/vp9.c:4164:29
     #7 0x1a3fc96 in avcodec_decode_video2
 /home/user/code/ffmpeg/libavcodec/utils.c:2107:19
     #8 0x589546 in decode_video /home/user/code/ffmpeg/ffmpeg.c:2069:11
     #9 0x589546 in process_input_packet
 /home/user/code/ffmpeg/ffmpeg.c:2318
     #10 0x5990bc in process_input /home/user/code/ffmpeg/ffmpeg.c:3980:5
     #11 0x5726c6 in transcode_step /home/user/code/ffmpeg/ffmpeg.c:4068:11
     #12 0x5726c6 in transcode /home/user/code/ffmpeg/ffmpeg.c:4122
     #13 0x56f73c in main /home/user/code/ffmpeg/ffmpeg.c:4314:9
     #14 0x7f30cf98eec4 in __libc_start_main /build/buildd/eglibc-2.19/csu
 /libc-start.c:287
     #15 0x466445 in _start
 (/home/user/Desktop/ffmpeg/ffmpeg_full+0x466445)
 }}}

--
Ticket URL: <https://trac.ffmpeg.org/ticket/5130>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker