1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00

lavc/vvc: Set fc->ref to NULL at top of decode_nal_units

In the fail: block of decode_nal_units, a check as to whether fc->ref is
nonzero is used.  Before this patch, fc->ref was set to NULL in
frame_context_setup.  The issue is that, by the time frame_context_setup
is called, falliable functions (namely slices_realloc and
ff_vvc_decode_frame_ps) have already been called.  Therefore, there
could arise a situation in which the fc->ref test of decode_nal_units'
fail: block is performed while fc->ref has an invalid value.  This seems
to be particularly prevalent in situations where the FrameContexts are
being reused.  The patch resolves the issue by moving the assignment of
fc->ref to NULL to the very top of decode_nal_units, before any falliable
functions are called.

Signed-off-by: Frank Plowman <post@frankplowman.com>
This commit is contained in:
Frank Plowman
2025-02-08 21:42:56 +00:00
committed by Nuo Mi
parent a50d36b5fd
commit e417f939da

View File

@ -671,8 +671,6 @@ static int frame_context_setup(VVCFrameContext *fc, VVCContext *s)
{ {
int ret; int ret;
fc->ref = NULL;
// copy refs from the last frame // copy refs from the last frame
if (s->nb_frames && s->nb_fcs > 1) { if (s->nb_frames && s->nb_fcs > 1) {
VVCFrameContext *prev = get_frame_context(s, fc, -1); VVCFrameContext *prev = get_frame_context(s, fc, -1);
@ -927,6 +925,7 @@ static int decode_nal_units(VVCContext *s, VVCFrameContext *fc, AVPacket *avpkt)
int ret = 0; int ret = 0;
s->last_eos = s->eos; s->last_eos = s->eos;
s->eos = 0; s->eos = 0;
fc->ref = NULL;
ff_cbs_fragment_reset(frame); ff_cbs_fragment_reset(frame);
ret = ff_cbs_read_packet(s->cbc, frame, avpkt); ret = ff_cbs_read_packet(s->cbc, frame, avpkt);