can anybody take a look?

This is in the ffmpeg code, but looks like somebody that knows the ogg format will need to look at it.

https://cs.chromium.org/chromium/src/third_party/ffmpeg/libavformat/oggparseogm.c?l=174
174:    lb = ((*p & 2) << 1) | ((*p >> 6) & 3);
178:    while (lb--)
179:        os->pduration += p[lb+1] << (lb*8);

So lb can be 0-7, and it will shift bytes by 8/16/24/32/40/48. But pduration is a 32-bit int, so shifts of 32/40/48 don't make sense. Not sure what should happen to pduration when lb is large.

It appears that this field represents the duration represented as 0-7 bytes. So if the top few bytes are not 0, then the duration exceeds 32-bit int. So maybe the code needs to become:
    lb = ((*p & 2) << 1) | ((*p >> 6) & 3);
    while (lb-- >= 4)
        if (p[lb+1] != 0)
            return <some-sort-of-error>;
    while (lb--)
        os->pduration += p[lb+1] << (lb*8);

I checked the latest ffmpeg source (https://github.com/FFmpeg/FFmpeg/blob/master/libavformat/oggparseogm.c) and this code is unchanged, so upgrading to the current ffmpeg won't fix this.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/7d9f5804e4cc4bb6cc55133137a6e2060aa106b7 (roll clang 255169:257953).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

This bug predates that CL by months.

=>Chris for ffmpeg roll.

ClusterFuzz has detected this issue as fixed in range 517698:517712.

Detailed report: https://clusterfuzz.com/testcase?key=5341060371054592

Fuzzer: ochang_search_index_mutator
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  ogm_packet
  ogg_packet
  ogg_read_packet
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=370022:370027
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=517698:517712

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5341060371054592

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5341060371054592 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.