virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

avcodec/vp3: Fix undefined pointer arithmetic

Browse Source 
When decoding a keyframe, last_frame and golden_frame are
not used at all and (at least when starting decoding)
are not set at all. But due to code sharing pointer arithmetic
on the NULL data-pointers of these frames has nevertheless
been performed. This is undefined behaviour and causes e.g.
"runtime error: applying non-zero offset 173440 to null pointer"
from UBSan in the vp31, vp4, theora-coeff-level64 and theora-offset
FATE-tests.

Fix this by reusing the current frame for unavailable frames.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2023-09-14 21:22:55 +02:00
parent f9b6e3e48d
commit 3614f7e1cc
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/vp3.c
View File

@ -2056,6 +2056,14 @@ static void render_slice(Vp3DecodeContext *s, int slice)
{ {
int16_t *block = s->block; int16_t *block = s->block;
int motion_x = 0xdeadbeef, motion_y = 0xdeadbeef; int motion_x = 0xdeadbeef, motion_y = 0xdeadbeef;
/* When decoding keyframes, the earlier frames may not be available,
* so to avoid using undefined pointer arithmetic on them we just
* use the current frame instead. Nothing is ever read from these
* frames in case of a keyframe. */
const AVFrame *last_frame = s->last_frame.f->data[0] ?
s->last_frame.f : s->current_frame.f;
const AVFrame *golden_frame = s->golden_frame.f->data[0] ?
s->golden_frame.f : s->current_frame.f;
int motion_halfpel_index; int motion_halfpel_index;
int first_pixel; int first_pixel;
@ -2065,9 +2073,9 @@ static void render_slice(Vp3DecodeContext *s, int slice)
for (int plane = 0; plane < 3; plane++) { for (int plane = 0; plane < 3; plane++) {
uint8_t *output_plane = s->current_frame.f->data[plane] + uint8_t *output_plane = s->current_frame.f->data[plane] +
s->data_offset[plane]; s->data_offset[plane];
const uint8_t *last_plane = s->last_frame.f->data[plane] + const uint8_t *last_plane = last_frame->data[plane] +
s->data_offset[plane]; s->data_offset[plane];
const uint8_t *golden_plane = s->golden_frame.f->data[plane] + const uint8_t *golden_plane = golden_frame->data[plane] +
s->data_offset[plane]; s->data_offset[plane];
ptrdiff_t stride = s->current_frame.f->linesize[plane]; ptrdiff_t stride = s->current_frame.f->linesize[plane];
int plane_width = s->width >> (plane && s->chroma_x_shift); int plane_width = s->width >> (plane && s->chroma_x_shift);