<div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi,</div><div><br></div><div> I tested on the given patch, it does not crash any more on the poc file (attached).</div><div> I tried `./x264-fuzz/install/bin/x264 <b>--profile baseline</b> --threads 4 --quiet --output /dev/null $FILE' on *unpatched version* and it reports a heap-buffer-overflow at me.c:244.</div><div> With the patched version, this works fine.</div><div dir="ltr"><br clear="all"><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><font color="#313131" face="Arial, sans-serif"><span style="font-size:12px">Best Regards,</span></font><div><font color="#313131" face="Arial, sans-serif"><span style="font-size:12px">Hongxu</span></font></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Apr 13, 2019 at 4:22 AM BugMaster <<a href="mailto:BugMaster@narod.ru">BugMaster@narod.ru</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Tue, 9 Apr 2019 16:01:31 +0800, Hongxu Chen wrote:<br>
> Hi,<br>
<br>
> On my machine, when running x264 with 4 threads (sandbox<br>
> version, git HEAD d4099dd4c722f52c4f3c14575d7d39eb8fadb97f), it may<br>
> cause a heap-buffer-overflow (read) at encoder/me.c:406.<br>
<br>
<br>
> $ ./x264-asan/install/bin/x264 --threads 4 --quiet --output /dev/null hbo_me.c:406_1<br>
> =================================================================<br>
> ==23250==ERROR: AddressSanitizer: heap-buffer-overflow on address<br>
> 0x621000030904 at pc 0x000000755471 bp 0x7fadac672df0 sp 0x7fadac672de8<br>
> READ of size 2 at 0x621000030904 thread T4<br>
> #0 0x755470 in x264_8_me_search_ref<br>
> /home/hongxu/work/x264/x264-asan/encoder/me.c:406:13<br>
> #1 0x6df538 in mb_analyse_inter_p16x16<br>
> /home/hongxu/work/x264/x264-asan/encoder/analyse.c:1275:13<br>
> #2 0x6df538 in x264_8_macroblock_analyse<br>
> /home/hongxu/work/x264/x264-asan/encoder/analyse.c:3026<br>
> #3 0x59f274 in slice_write<br>
> /home/hongxu/work/x264/x264-asan/encoder/encoder.c:2775:9<br>
> #4 0x591bee in slices_write<br>
> /home/hongxu/work/x264/x264-asan/encoder/encoder.c:3116:13<br>
> #5 0x5a9fdf in threadpool_thread_internal<br>
> /home/hongxu/work/x264/x264-asan/common/threadpool.c:69:20<br>
> #6 0x5fefeb in x264_stack_align<br>
> (/home/hongxu/work/x264/x264-asan/install/bin/x264+0x5fefeb)<br>
<br>
> 0x621000030904 is located 2 bytes to the right of 4098-byte region [0x62100002f900,0x621000030902)<br>
> allocated by thread T0 here:<br>
> #0 0x4d4948 in __interceptor_memalign.localalias.1<br>
> (/home/hongxu/work/x264/x264-asan/install/bin/x264+0x4d4948)<br>
> #1 0x548fcc in x264_malloc<br>
> /home/hongxu/work/x264/x264-asan/common/base.c:124:21<br>
<br>
> Thread T4 created by T0 here:<br>
> #0 0x4377a0 in pthread_create<br>
> (/home/hongxu/work/x264/x264-asan/install/bin/x264+0x4377a0)<br>
> #1 0x5a96e9 in x264_8_threadpool_init<br>
> /home/hongxu/work/x264/x264-asan/common/threadpool.c:111:13<br>
<br>
> SUMMARY: AddressSanitizer: heap-buffer-overflow<br>
> /home/hongxu/work/x264/x264-asan/encoder/me.c:406:13 in x264_8_me_search_ref<br>
> Shadow bytes around the buggy address:<br>
> 0x0c427fffe0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>
> 0x0c427fffe0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>
> 0x0c427fffe0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>
> 0x0c427fffe100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>
> 0x0c427fffe110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br>
=>>0x0c427fffe120:[02]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<br>
> 0x0c427fffe130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<br>
> 0x0c427fffe140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<br>
> 0x0c427fffe150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<br>
> 0x0c427fffe160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<br>
> 0x0c427fffe170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<br>
> Shadow byte legend (one shadow byte represents 8 application bytes):<br>
> Addressable: 00<br>
> Partially addressable: 01 02 03 04 05 06 07 <br>
> Heap left redzone: fa<br>
> Freed heap region: fd<br>
> Stack left redzone: f1<br>
> Stack mid redzone: f2<br>
> Stack right redzone: f3<br>
> Stack after return: f5<br>
> Stack use after scope: f8<br>
> Global redzone: f9<br>
> Global init order: f6<br>
> Poisoned by user: f7<br>
> Container overflow: fc<br>
> Array cookie: ac<br>
> Intra object redzone: bb<br>
> ASan internal: fe<br>
> Left alloca redzone: ca<br>
> Right alloca redzone: cb<br>
> ==23250==ABORTING<br>
> [1] 23250 abort ./x264-asan/install/bin/x264 --threads 4 --quiet --output /dev/null<br>
<br>
> When running with 1,2,3 threads, it crashes at different places such as encoder/me.c:244.<br>
> When running with 5 or more threads, everything seems fine.<br>
<br>
> Best Regards,<br>
> Hongxu<br>
<br>
Hi.<br>
<br>
Do this happen only with interlaced encoding?<br>
Can you test with attached patch. It should fix heap-buffer-overflow<br>
(read) with interlaced encoding._______________________________________________<br>
x264-devel mailing list<br>
<a href="mailto:x264-devel@videolan.org" target="_blank">x264-devel@videolan.org</a><br>
<a href="https://mailman.videolan.org/listinfo/x264-devel" rel="noreferrer" target="_blank">https://mailman.videolan.org/listinfo/x264-devel</a><br>
</blockquote></div></div></div></div>