Similar to #220
Version: 0.3.0.0
OS: Debian 12
Command: ./oapv_app_dec -i poc_vlc_integer_overflow.apv -m 1 -v 0
Attached is a zip with the file needed to reproduce this, assuming oapv_app_dec was built with UBSAN
UBSAN Trace
<removed>/app/oapv_app_util.h:364:37: runtime error: signed integer overflow: 33554432 * 16777216 cannot be represented in type 'int'
#0 0x5a4a8631fec9 in imgb_create <removed>/app/oapv_app_util.h:364:37
#1 0x5a4a86322e61 in main <removed>/app/oapv_app_dec.c
#2 0x709133eda249 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#3 0x709133eda304 in __libc_start_main csu/../csu/libc-start.c:360:3
#4 0x5a4a86261420 in _start (<removed>/build/bin/oapv_app_dec+0x51420) (BuildId: 56db50aa25683e3033552d96267c16b1450aad86)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior <removed>/app/oapv_app_util.h:364:37 in
poc.zip
Similar to #220
Version: 0.3.0.0
OS: Debian 12
Command:
./oapv_app_dec -i poc_vlc_integer_overflow.apv -m 1 -v 0Attached is a zip with the file needed to reproduce this, assuming
oapv_app_decwas built with UBSANUBSAN Trace
poc.zip