A SIGSEGV signal appear when running program Thordec about thor

[stemidts]

Thanks for the report. Can you specify the commit id you're using to decode?

[fCorleone]

I have checked the commit id, it's commit e42047d.It's strange that I cloned the code from the https://github.com/cisco/thor.git 12 days ago. Does it mean that I would get the latest version of the code? But when I check the commit id using command line:

git reflog

I got this :

e42047d HEAD@{0}: clone: from https://github.com/cisco/thor.git

[stemidts]

Thanks. It looks to me that the bitstream contains illegal elements, which indicates that there is an encoder bug as well. Are you able to share how you produced the stream? (config file, options & input video)

Does the following patch for you work? (it should fix the crash, but the file will not be decodable):
patch.txt

[fCorleone]

My command line to produce the stream is like:

./Thordec test.bit out.yuv

with no options and config file , I just try to input a file and the issue happened.
The input file has been placed at:https://github.com/fCorleone/fuzz_programs/blob/master/thor/test.bit
I will try the patch later.
By the way, I'm wondering that could I get a CVE ID for this issue?
Thank you for your reply to this issue anyway.

[stemidts]

I meant the Thorenc command used to produce test.bit (and test2.bit in #37)

[fCorleone]

Oh, the test bit was not produced by Thorenc using a certain video. The test bit was created in fuzzing process. I put a seed into the fuzzing process and afl mutated the seed and got the test bit which would make a crash to the program.

[fCorleone]

@stemidts Could I get CVE-IDs for this two issues please?

[stemidts]

We haven't issued CVE's yet. In order for me to understand this problem correctly, it would be helpful if you could give feedback whether the patch helps.

[fCorleone]

Yes , the patch fix the problem for me.

[fCorleone]

@stemidts will I get CVE-ids for these two issues?

[stemidts]

The issues seem to have the same root cause and the CVD ID is CVE-2018-0429.

A patch has been committed into the repository.