[FFmpeg-devel] [PATCH 3/3] avcodec/cbs_h2645: Avoid function pointer casts, fix UB

[Andreas Rheinhardt <andreas.rheinhardt@outlook.com>]

The SEI message read/write functions are called
via function pointers where the SEI message-specific
context is passed as void*. But the actual function
definitions use a pointer to their proper context
in place of void*, making the calls undefined behaviour.
Clang UBSan 17 warns about this.

This commit fixes this by making the functions match
the type of the call. This reduced the number of failing
FATE tests with UBSan from 164 to 85 here.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavcodec/cbs_h264_syntax_template.c | 24 ++++++++++-----------
 libavcodec/cbs_h265_syntax_template.c | 31 +++++++++++++++++----------
 libavcodec/cbs_h266_syntax_template.c |  6 +++---
 libavcodec/cbs_sei.h                  |  8 +++----
 libavcodec/cbs_sei_syntax_template.c  | 23 ++++++++++++--------
 5 files changed, 52 insertions(+), 40 deletions(-)

diff --git a/libavcodec/cbs_h264_syntax_template.c b/libavcodec/cbs_h264_syntax_template.c
index 0f8bba4a0d..282cd24292 100644
--- a/libavcodec/cbs_h264_syntax_template.c
+++ b/libavcodec/cbs_h264_syntax_template.c
@@ -511,9 +511,9 @@ static int FUNC(pps)(CodedBitstreamContext *ctx, RWContext *rw,
 }
 
 static int FUNC(sei_buffering_period)(CodedBitstreamContext *ctx, RWContext *rw,
-                                      H264RawSEIBufferingPeriod *current,
-                                      SEIMessageState *sei)
+                                      void *current_, SEIMessageState *sei)
 {
+    H264RawSEIBufferingPeriod *current = current_;
     CodedBitstreamH264Context *h264 = ctx->priv_data;
     const H264RawSPS *sps;
     int err, i, length;
@@ -605,9 +605,9 @@ static int FUNC(sei_pic_timestamp)(CodedBitstreamContext *ctx, RWContext *rw,
 }
 
 static int FUNC(sei_pic_timing)(CodedBitstreamContext *ctx, RWContext *rw,
-                                H264RawSEIPicTiming *current,
-                                SEIMessageState *sei)
+                                void *current_, SEIMessageState *sei)
 {
+    H264RawSEIPicTiming *current = current_;
     CodedBitstreamH264Context *h264 = ctx->priv_data;
     const H264RawSPS *sps;
     int err;
@@ -677,9 +677,9 @@ static int FUNC(sei_pic_timing)(CodedBitstreamContext *ctx, RWContext *rw,
 }
 
 static int FUNC(sei_pan_scan_rect)(CodedBitstreamContext *ctx, RWContext *rw,
-                                   H264RawSEIPanScanRect *current,
-                                   SEIMessageState *sei)
+                                   void *current_, SEIMessageState *sei)
 {
+    H264RawSEIPanScanRect *current = current_;
     int err, i;
 
     HEADER("Pan-Scan Rectangle");
@@ -704,9 +704,9 @@ static int FUNC(sei_pan_scan_rect)(CodedBitstreamContext *ctx, RWContext *rw,
 }
 
 static int FUNC(sei_recovery_point)(CodedBitstreamContext *ctx, RWContext *rw,
-                                    H264RawSEIRecoveryPoint *current,
-                                    SEIMessageState *sei)
+                                    void *current_, SEIMessageState *sei)
 {
+    H264RawSEIRecoveryPoint *current = current_;
     int err;
 
     HEADER("Recovery Point");
@@ -720,9 +720,9 @@ static int FUNC(sei_recovery_point)(CodedBitstreamContext *ctx, RWContext *rw,
 }
 
 static int FUNC(film_grain_characteristics)(CodedBitstreamContext *ctx, RWContext *rw,
-                                            H264RawFilmGrainCharacteristics *current,
-                                            SEIMessageState *state)
+                                            void *current_, SEIMessageState *state)
 {
+    H264RawFilmGrainCharacteristics *current = current_;
     CodedBitstreamH264Context *h264 = ctx->priv_data;
     const H264RawSPS *sps;
     int err, c, i, j;
@@ -803,9 +803,9 @@ static int FUNC(film_grain_characteristics)(CodedBitstreamContext *ctx, RWContex
 }
 
 static int FUNC(sei_display_orientation)(CodedBitstreamContext *ctx, RWContext *rw,
-                                         H264RawSEIDisplayOrientation *current,
-                                         SEIMessageState *sei)
+                                         void *current_, SEIMessageState *sei)
 {
+    H264RawSEIDisplayOrientation *current = current_;
     int err;
 
     HEADER("Display Orientation");
diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c
index 2d4b954718..53ae0cabff 100644
--- a/libavcodec/cbs_h265_syntax_template.c
+++ b/libavcodec/cbs_h265_syntax_template.c
@@ -1620,8 +1620,9 @@ static int FUNC(slice_segment_header)(CodedBitstreamContext *ctx, RWContext *rw,
 
 static int FUNC(sei_buffering_period)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIBufferingPeriod *current, SEIMessageState *sei)
+     void *current_, SEIMessageState *sei)
 {
+    H265RawSEIBufferingPeriod *current = current_;
     CodedBitstreamH265Context *h265 = ctx->priv_data;
     const H265RawSPS *sps;
     const H265RawHRDParameters *hrd;
@@ -1730,8 +1731,9 @@ static int FUNC(sei_buffering_period)
 
 static int FUNC(sei_pic_timing)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIPicTiming *current, SEIMessageState *sei)
+     void *current_, SEIMessageState *sei)
 {
+    H265RawSEIPicTiming *current = current_;
     CodedBitstreamH265Context *h265 = ctx->priv_data;
     const H265RawSPS *sps;
     const H265RawHRDParameters *hrd;
@@ -1806,8 +1808,9 @@ static int FUNC(sei_pic_timing)
 
 static int FUNC(sei_pan_scan_rect)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIPanScanRect *current, SEIMessageState *sei)
+     void *current_, SEIMessageState *sei)
 {
+    H265RawSEIPanScanRect *current = current_;
     int err, i;
 
     HEADER("Pan-Scan Rectangle");
@@ -1833,8 +1836,9 @@ static int FUNC(sei_pan_scan_rect)
 
 static int FUNC(sei_recovery_point)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIRecoveryPoint *current, SEIMessageState *sei)
+     void *current_, SEIMessageState *sei)
 {
+    H265RawSEIRecoveryPoint *current = current_;
     int err;
 
     HEADER("Recovery Point");
@@ -1848,9 +1852,9 @@ static int FUNC(sei_recovery_point)
 }
 
 static int FUNC(film_grain_characteristics)(CodedBitstreamContext *ctx, RWContext *rw,
-                                            H265RawFilmGrainCharacteristics *current,
-                                            SEIMessageState *state)
+                                            void *current_, SEIMessageState *state)
 {
+    H265RawFilmGrainCharacteristics *current = current_;
     CodedBitstreamH265Context *h265 = ctx->priv_data;
     const H265RawSPS *sps = h265->active_sps;
     int err, c, i, j;
@@ -1914,8 +1918,9 @@ static int FUNC(film_grain_characteristics)(CodedBitstreamContext *ctx, RWContex
 
 static int FUNC(sei_display_orientation)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIDisplayOrientation *current, SEIMessageState *sei)
+     void *current_, SEIMessageState *sei)
 {
+    H265RawSEIDisplayOrientation *current = current_;
     int err;
 
     HEADER("Display Orientation");
@@ -1933,8 +1938,9 @@ static int FUNC(sei_display_orientation)
 
 static int FUNC(sei_active_parameter_sets)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIActiveParameterSets *current, SEIMessageState *sei)
+     void *current_, SEIMessageState *sei)
 {
+    H265RawSEIActiveParameterSets *current = current_;
     CodedBitstreamH265Context *h265 = ctx->priv_data;
     const H265RawVPS *vps;
     int err, i;
@@ -1970,8 +1976,9 @@ static int FUNC(sei_active_parameter_sets)
 
 static int FUNC(sei_decoded_picture_hash)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIDecodedPictureHash *current, SEIMessageState *sei)
+     void *current_, SEIMessageState *sei)
 {
+    H265RawSEIDecodedPictureHash *current = current_;
     CodedBitstreamH265Context *h265 = ctx->priv_data;
     const H265RawSPS *sps = h265->active_sps;
     int err, c, i;
@@ -2002,8 +2009,9 @@ static int FUNC(sei_decoded_picture_hash)
 
 static int FUNC(sei_time_code)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEITimeCode *current, SEIMessageState *sei)
+     void *current_, SEIMessageState *sei)
 {
+    H265RawSEITimeCode *current = current_;
     int err, i;
 
     HEADER("Time Code");
@@ -2053,8 +2061,9 @@ static int FUNC(sei_time_code)
 
 static int FUNC(sei_alpha_channel_info)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     H265RawSEIAlphaChannelInfo *current, SEIMessageState *sei)
+     void *current_, SEIMessageState *sei)
 {
+    H265RawSEIAlphaChannelInfo *current = current_;
     int err, length;
 
     HEADER("Alpha Channel Information");
diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index e75f2f6971..8a2adeb9e4 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -3428,10 +3428,10 @@ static int FUNC(slice_header) (CodedBitstreamContext *ctx, RWContext *rw,
 }
 
 static int FUNC(sei_decoded_picture_hash) (CodedBitstreamContext *ctx,
-                                           RWContext *rw,
-                                           H266RawSEIDecodedPictureHash *
-                                           current, SEIMessageState *unused)
+                                           RWContext *rw, void *current_,
+                                           SEIMessageState *unused)
 {
+    H266RawSEIDecodedPictureHash *current = current_;
     int err, c_idx, i;
 
     HEADER("Decoded Picture Hash");
diff --git a/libavcodec/cbs_sei.h b/libavcodec/cbs_sei.h
index 4511c506cc..6d1bed4171 100644
--- a/libavcodec/cbs_sei.h
+++ b/libavcodec/cbs_sei.h
@@ -126,12 +126,10 @@ typedef struct SEIMessageTypeDescriptor {
     SEIMessageWriteFunction write;
 } SEIMessageTypeDescriptor;
 
-// Macro for the read/write pair.  The clumsy cast is needed because the
-// current pointer is typed in all of the read/write functions but has to
-// be void here to fit all cases.
+// Macro for the read/write pair.
 #define SEI_MESSAGE_RW(codec, name) \
-    .read  = (SEIMessageReadFunction) cbs_ ## codec ## _read_  ## name, \
-    .write = (SEIMessageWriteFunction)cbs_ ## codec ## _write_ ## name
+    .read  = cbs_ ## codec ## _read_  ## name, \
+    .write = cbs_ ## codec ## _write_ ## name
 
 // End-of-list sentinel element.
 #define SEI_MESSAGE_TYPE_END { .type = -1 }
diff --git a/libavcodec/cbs_sei_syntax_template.c b/libavcodec/cbs_sei_syntax_template.c
index 62dd1dabaa..16d2cbc406 100644
--- a/libavcodec/cbs_sei_syntax_template.c
+++ b/libavcodec/cbs_sei_syntax_template.c
@@ -18,8 +18,9 @@
 
 static int FUNC(filler_payload)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawFillerPayload *current, SEIMessageState *state)
+     void *current_, SEIMessageState *state)
 {
+    SEIRawFillerPayload *current = current_;
     int err, i;
 
     HEADER("Filler Payload");
@@ -36,8 +37,9 @@ static int FUNC(filler_payload)
 
 static int FUNC(user_data_registered)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawUserDataRegistered *current, SEIMessageState *state)
+     void *current_, SEIMessageState *state)
 {
+    SEIRawUserDataRegistered *current = current_;
     int err, i, j;
 
     HEADER("User Data Registered ITU-T T.35");
@@ -68,8 +70,9 @@ static int FUNC(user_data_registered)
 
 static int FUNC(user_data_unregistered)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawUserDataUnregistered *current, SEIMessageState *state)
+     void *current_, SEIMessageState *state)
 {
+    SEIRawUserDataUnregistered *current = current_;
     int err, i;
 
     HEADER("User Data Unregistered");
@@ -96,8 +99,9 @@ static int FUNC(user_data_unregistered)
 
 static int FUNC(mastering_display_colour_volume)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawMasteringDisplayColourVolume *current, SEIMessageState *state)
+     void *current_, SEIMessageState *state)
 {
+    SEIRawMasteringDisplayColourVolume *current = current_;
     int err, c;
 
     HEADER("Mastering Display Colour Volume");
@@ -118,8 +122,9 @@ static int FUNC(mastering_display_colour_volume)
 
 static int FUNC(content_light_level_info)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawContentLightLevelInfo *current, SEIMessageState *state)
+     void *current_, SEIMessageState *state)
 {
+    SEIRawContentLightLevelInfo *current = current_;
     int err;
 
     HEADER("Content Light Level Information");
@@ -132,9 +137,9 @@ static int FUNC(content_light_level_info)
 
 static int FUNC(alternative_transfer_characteristics)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawAlternativeTransferCharacteristics *current,
-     SEIMessageState *state)
+     void *current_, SEIMessageState *state)
 {
+    SEIRawAlternativeTransferCharacteristics *current = current_;
     int err;
 
     HEADER("Alternative Transfer Characteristics");
@@ -146,9 +151,9 @@ static int FUNC(alternative_transfer_characteristics)
 
 static int FUNC(ambient_viewing_environment)
     (CodedBitstreamContext *ctx, RWContext *rw,
-     SEIRawAmbientViewingEnvironment *current,
-     SEIMessageState *state)
+     void *current_, SEIMessageState *state)
 {
+    SEIRawAmbientViewingEnvironment *current = current_;
     static const uint16_t max_ambient_light_value = 50000;
     int err;
 
-- 
2.40.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".