UBSan error: applying zero offset to null pointer in bstr.h

mpv Information

mpv v0.41.0-744-g304426c39 Copyright © 2000-2026 mpv/MPlayer/mplayer2 projects
 built on Jun 10 2026 15:19:06
libplacebo version: v7.360.1 (v7.360.1)
FFmpeg version: 7.1.4-0+deb13u1
FFmpeg library versions:
   libavcodec      61.19.101
   libavfilter     10.5.100
   libavformat     61.7.102
   libavutil       59.39.100
   libswresample   5.3.100
   libswscale      8.3.100

Other Information

N/A

Reproduction Steps

Run the repro.

Expected Behavior

No undefined behavior.

Actual Behavior

There is undefined behavior.

Log File

INFO: Running with entropic power schedule (0xFF, 100).
build-fuzz/fuzzers/fuzzer_load_config_file: Running 1 inputs 1 time(s) each.
Running: /home/user/mpv_repro/repro-profile-bare.conf
../misc/bstr.h:237:36: runtime error: applying zero offset to null pointer
    #0 0x7fc54249ed2d in bstr_cut /home/user/software_ws/mpv_ws/mpv/build-fuzz/../misc/bstr.h:237:36
    #1 0x7fc54249ed2d in get_nextsep /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_option.c:1395:19
    #2 0x7fc54249dbd0 in separate_input_param /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_option.c:1429:26
    #3 0x7fc5424740b3 in parse_str_list_impl /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_option.c:1518:11
    #4 0x7fc5424740b3 in parse_str_list /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_option.c:1623:12
    #5 0x7fc542465051 in m_option_parse /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_option.c:73:9
    #6 0x7fc542458391 in m_config_set_option_cli /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_config_frontend.c:762:9
    #7 0x7fc54245ef63 in m_config_set_profile_option /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_config_frontend.c:966:13
    #8 0x7fc5424b1ef6 in m_config_parse /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/parse_configfile.c:129:19
    #9 0x7fc5424b2a8f in m_config_parse_config_file /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/parse_configfile.c:171:13
    #10 0x7fc54251df1c in cmd_load_config_file /home/user/software_ws/mpv_ws/mpv/build-fuzz/../player/command.c:7256:13
    #11 0x7fc5424f5afd in run_command /home/user/software_ws/mpv_ws/mpv/build-fuzz/../player/command.c:5895:9
    #12 0x7fc5424da524 in run_client_command /home/user/software_ws/mpv_ws/mpv/build-fuzz/../player/client.c:1136:9
    #13 0x563420a7d7ee in LLVMFuzzerTestOneInput /home/user/software_ws/mpv_ws/mpv/build-fuzz/../fuzzers/fuzzer_load.c:87:17
    #14 0x56342097f50a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x5150a) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #15 0x563420967403 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x39403) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #16 0x56342096d541 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x3f541) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #17 0x5634209999f6 in main (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x6b9f6) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #18 0x7fc541435ca7  (/lib/x86_64-linux-gnu/libc.so.6+0x29ca7) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
    #19 0x7fc541435d64 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29d64) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
    #20 0x5634209619f0 in _start (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x339f0) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../misc/bstr.h:237:36 
==1073093== ERROR: libFuzzer: deadly signal
    #0 0x563420a44f45 in __sanitizer_print_stack_trace (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x116f45) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #1 0x563420998e8c in fuzzer::PrintStackTrace() (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x6ae8c) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #2 0x56342097de07 in fuzzer::Fuzzer::CrashCallback() (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x4fe07) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #3 0x7fc54144bdef  (/lib/x86_64-linux-gnu/libc.so.6+0x3fdef) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
    #4 0x7fc5414a095b  (/lib/x86_64-linux-gnu/libc.so.6+0x9495b) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
    #5 0x7fc54144bcc1 in raise (/lib/x86_64-linux-gnu/libc.so.6+0x3fcc1) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
    #6 0x7fc5414344ab in abort (/lib/x86_64-linux-gnu/libc.so.6+0x284ab) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
    #7 0x563420a61a8f in __sanitizer::Abort() (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x133a8f) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #8 0x563420a5f8c1 in __sanitizer::Die() (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x1318c1) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #9 0x563420a757a6 in __ubsan::ScopedReport::~ScopedReport() (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x1477a6) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #10 0x563420a7a00a in handlePointerOverflowImpl(__ubsan::PointerOverflowData*, unsigned long, unsigned long, __ubsan::ReportOptions) ubsan_handlers.cpp.o
    #11 0x563420a79b87 in __ubsan_handle_pointer_overflow (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x14bb87) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #12 0x7fc54249ed2d in bstr_cut /home/user/software_ws/mpv_ws/mpv/build-fuzz/../misc/bstr.h:237:36
    #13 0x7fc54249ed2d in get_nextsep /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_option.c:1395:19
    #14 0x7fc54249dbd0 in separate_input_param /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_option.c:1429:26
    #15 0x7fc5424740b3 in parse_str_list_impl /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_option.c:1518:11
    #16 0x7fc5424740b3 in parse_str_list /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_option.c:1623:12
    #17 0x7fc542465051 in m_option_parse /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_option.c:73:9
    #18 0x7fc542458391 in m_config_set_option_cli /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_config_frontend.c:762:9
    #19 0x7fc54245ef63 in m_config_set_profile_option /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/m_config_frontend.c:966:13
    #20 0x7fc5424b1ef6 in m_config_parse /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/parse_configfile.c:129:19
    #21 0x7fc5424b2a8f in m_config_parse_config_file /home/user/software_ws/mpv_ws/mpv/build-fuzz/../options/parse_configfile.c:171:13
    #22 0x7fc54251df1c in cmd_load_config_file /home/user/software_ws/mpv_ws/mpv/build-fuzz/../player/command.c:7256:13
    #23 0x7fc5424f5afd in run_command /home/user/software_ws/mpv_ws/mpv/build-fuzz/../player/command.c:5895:9
    #24 0x7fc5424da524 in run_client_command /home/user/software_ws/mpv_ws/mpv/build-fuzz/../player/client.c:1136:9
    #25 0x563420a7d7ee in LLVMFuzzerTestOneInput /home/user/software_ws/mpv_ws/mpv/build-fuzz/../fuzzers/fuzzer_load.c:87:17
    #26 0x56342097f50a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x5150a) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #27 0x563420967403 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x39403) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #28 0x56342096d541 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x3f541) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #29 0x5634209999f6 in main (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x6b9f6) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)
    #30 0x7fc541435ca7  (/lib/x86_64-linux-gnu/libc.so.6+0x29ca7) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
    #31 0x7fc541435d64 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29d64) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
    #32 0x5634209619f0 in _start (/home/user/software_ws/mpv_ws/mpv/build-fuzz/fuzzers/fuzzer_load_config_file+0x339f0) (BuildId: 7e1f96a4b6fa6caca7d3b9efe5b73ac0cfd4cd10)

NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal

Sample Files

mpv_repro.zip

I carefully read all instruction and confirm that I did the following:

• I tested and confirmed that the issue exists with the latest release version or newer.
• I provided all required information including system and mpv version.
• I produced the log file with the exact same set of files, parameters, and conditions used in "Reproduction Steps", with the addition of --log-file=output.txt.
• I produced the log file while the behaviors described in "Actual Behavior" were actively observed.
• I attached the full, untruncated log file.
• I attached the backtrace in the case of a crash.

Start with bstr_cut in misc/bstr.h at line 237 and trace its callers get_nextsep and separate_input_param in options/m_option.c. Use the attached repro with fuzzer_load_config_file to investigate the null-pointer offset during config parsing. Done means the repro no longer produces the UBSan error.