From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id C202547A3C for ; Fri, 26 Jul 2024 18:42:18 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 63F4068D69B; Fri, 26 Jul 2024 21:42:16 +0300 (EEST) Received: from EUR05-DB8-obe.outbound.protection.outlook.com (mail-db8eur05olkn2092.outbound.protection.outlook.com [40.92.89.92]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C65AB68D592 for ; Fri, 26 Jul 2024 21:42:09 +0300 (EEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ei7STQd/u4hhcAzuIBJWFpSjscwiHLiJnUTDsJacx9TJae615SartCj2oUIoA0asGZ9EiOZy+uUbmvn9ZwHTqdvXaGDi140JWEJsCOiv7L99n5Q2x48uxPa7XDAYUcRz1EAbbB1dGnJ/T+AAKOBKXyDZnKNPQhAWMX7ib69RYm5/prpCU2f0sc6kdHcJAccenzGLVopiA9fqm+rh7wBXq+xUzqOxv3tEIXD6gZSa5cKJEih7PjcvK0aQW+mZgM8YRMY/KNb1DjeIoqRoPvXrxD7QQglaVui5szv5+htawb1TU1aHmm8PIhaJ+xY1yyoIH4ZxTuV6JsxDi8xdk56bqA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2ktbbXFc8J43NTqTOHrhSgFzvmYGFtiHGIqd+bzBGlA=; b=FG4ug7BRbJIdRuqh/b4aw2gH6OhlWmy9174fCWrajrMcioj9SPqJFgCeazws7smUzclvae4DC5z3PqqCYHdTqw1vkvIHhgSp1dOJpCMoCu86IqEwHw60Q9AYlIIY/cIKU2qaKIaEu93EJtNE8Hq7aivsFDxVhyhqRH2kVWgq5A+B803Vf9glJTHQCcRCN86VoUkuVdhu9t4xE7VeJknKVZpiH93cjFtfYNI8y2CjizR5Tj5Ax5l3msN8jOq1M+3yqnDR7qg0REp1wQS06TNNNWNuLbm8KZNSjohC1lNvSnvq2Jb+HZ+co4JFgflvoF35I6fdwprTmwG0WkX4kdtYlw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2ktbbXFc8J43NTqTOHrhSgFzvmYGFtiHGIqd+bzBGlA=; b=KeHVTFdBpdoZSK39pbL1IRT41cdhu8Kc1PCqk+M2pcef1oMzoA4o/OmA1ItgvP36YTrvJbWmzq1epwiCju+7//9VgGPpMeHsSck/yOzCrA3xpRs89+NjWbUxu+7LGr4RktQdHzifjaN1/r5JipCy7vXP931b/t8m5qc7MAHGvXxZW0sJ4gQ+NOzgE/3Oe/YxO4eLMf8nZ8hplokGjPt2Bf90vm80cgYixpZsJ4lwhftgcHajZCy8i1p4+W2xrcIgqkgaWpiztVQyGJGBVIgn8FFVnQKJvImg2P6koSOyxkXuXFDkGFEe2YOQpMbdBwXVknIyo6Cx0d2CFhkxQjjatg== Received: from GV1P250MB0737.EURP250.PROD.OUTLOOK.COM (2603:10a6:150:8e::17) by AS8P250MB0268.EURP250.PROD.OUTLOOK.COM (2603:10a6:20b:37f::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7784.29; Fri, 26 Jul 2024 18:42:07 +0000 Received: from GV1P250MB0737.EURP250.PROD.OUTLOOK.COM ([fe80::d6a1:e3af:a5f1:b614]) by GV1P250MB0737.EURP250.PROD.OUTLOOK.COM ([fe80::d6a1:e3af:a5f1:b614%2]) with mapi id 15.20.7784.017; Fri, 26 Jul 2024 18:42:07 +0000 From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Fri, 26 Jul 2024 20:41:59 +0200 Message-ID: X-Mailer: git-send-email 2.40.1 X-TMN: [UnkG9YflaPEwHmRBYYJ16nFoqVGIkKUh2Lh31c1EvHI=] X-ClientProxiedBy: ZR0P278CA0030.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:1c::17) To GV1P250MB0737.EURP250.PROD.OUTLOOK.COM (2603:10a6:150:8e::17) X-Microsoft-Original-Message-ID: <20240726184159.2919893-1-andreas.rheinhardt@outlook.com> MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: GV1P250MB0737:EE_|AS8P250MB0268:EE_ X-MS-Office365-Filtering-Correlation-Id: 7d9f5d84-6198-4be5-9376-08dcada2a6a3 X-Microsoft-Antispam: BCL:0; ARA:14566002|8060799006|19110799003|5072599006|461199028|1602099012|440099028|3412199025|4302099013|1710799026; X-Microsoft-Antispam-Message-Info: zNi8effRkuZ5ann9mDLtshrE6ya1WX08sqRo3S7IaTWPu0ShzhAYNdWfpZmBPMt3hwDE6eQ698pvMceaVGj38Ur0kpqqasPdZANpAFcuiGngyVmb7BdPLbGNkY1fHSjq2W44P3R4x3t5yR7mjW6CCnN+zvCKQ+UukDH7eZ8TEXyRwAv3d09DpctM5NnJZKxXBf1+H2KAVOV633dwHyvdU1XurgNbt/XsrF8I64YGXlRAaQiD8iGhYvV9eI3nxLe5h0JvK0/UXH6XzJGP9vOkhgQkHfX2ar8ITkhYytjypl3PRDoTo9tEB6LDeoz/Oc4ZCSpbKi6OHdlVCOT7CcvzsVPxH8XToGQ2ggXYvQtisRwyWs2e580IMEi0DUPMXwgEdK4PMd1roJ18CydpqyhyA91EW9X30RRoy4ujZhsLWNHLbTjXAJXdJKDSQyFYJ99ppGhCBo/6HOg40gqhTQy+1ORbsfGR2FsPCOPVmjL2v2CGGU+R2bKOC6e2NGnUwzEkhbO+gp/uPZ6OzsJranL8MPhuVqz2tMcPAQ5vcuxQnsXM3K9PI03iSuJHEY5BLbq/FgnKRICuyL+xe+DF0B0RDSW7MA2HW9aQtLeKJvUwBvkKXaz7SutXx0h456a2RSucJGpZIYi0Sa9A6vBMd2PhpsO/H23i/tZOO9Ew5vR/lqeyOzrpwMkFvScf/fvKwzrRF7e9aTLBnRTIHRT3skqp+5LVCw5i6vt+O0zuTzrJiTYW7es9sj84ClBOcNE2o+UAds0/gbtbkqh487NeNp8woewhkQPAm6cIRiXm051gokoroatLzJqn7j+JPz6A3PLX X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?MJXZJwFws1AwLLS1j9H2g2tgbvQHYj63CJG1oIckSU3KvSvY9exyv0Kse5Ux?= =?us-ascii?Q?RIkOl2BZsa1XNxRGLz/6yb+QNvmTOQwTVgVWkfqA7JOwDR9KF1jBgp2mS8Nk?= =?us-ascii?Q?pPkk8b72zHrBT/uZ0Sc3ElcSyfZKcM0UHm6qcS2l2T8mNPkpXrTbD7BQRW5W?= =?us-ascii?Q?GyYoWCF8igVGAR6PnYn6RNn6v67uQYn+kWcEV3eu7xe5St3TKTb5IRlrhEAk?= =?us-ascii?Q?uU7Uag1cxIcpp6nGK0R7HK5WwXl/IhGp3oWE6Gh4yztA2tmT9u1Yw900xZCu?= =?us-ascii?Q?yJb24aZk5+xHIQ5dcYSYzfsZaSaWefMUpBRJUZa/X7OPm1OL9/++ZNjIv+w7?= =?us-ascii?Q?aTBkoQFLJTKd4jrDGnFTCXMSXrhFaTHOGskns4tEdZldppdQICJ2MA/l63zy?= =?us-ascii?Q?BWtgbLJYy/fOAC/9Rm9YJddSdo2BxIECkD+D8oCysVy5LC7la7VICNJR2hth?= =?us-ascii?Q?cs3WfCwmyHLw9dsxXMb/ZAWfeMs6hcuj0HTd2IDpqRHcia6mKbmIKy8Enwug?= =?us-ascii?Q?Z92p1dVQQj0bKT6s5BKv0kNxnCEE1M+QEfXuCuKX0hrgS7+EX2X2GsTBEE4O?= =?us-ascii?Q?VbIxWWoZd3mFcTrfkeaT8AdHnPguJ3CzGN1rHHXEvmRCJxQWp6o85TfLpkUu?= =?us-ascii?Q?XdgWnasVSP7OYJ6ie25cs5AX/XgUxA7zWMgxXh0tTAocahkd4w8n2s5Q/i6s?= =?us-ascii?Q?/c6Z+/lEEkwkeQooZoI1AMI8m5dY7ri9F0hlw3T880z0cqGOmnC1oH3LMPKl?= =?us-ascii?Q?lDbeVS41DrZAqsZzNnqCFhdt3kidGUuYZ4CF0McyYNz/QbejtWuL57if+4hV?= =?us-ascii?Q?jhgzrqncnL8TUenkp6w7Gd05AN9HaZ07kterk46nDpfIHEVKuJ776i4klHtz?= =?us-ascii?Q?JxnDD9ScyLL2Sg0YQt8gfY1PDYcEdMweHTBi88yd00J1OYQNTetkRRzcLw5Q?= =?us-ascii?Q?JoV6/p0myudLSwN2aRIixoaEoYbOG4mUUk3qLWDwzHEM0sMbk8CJaV5Pf0N1?= =?us-ascii?Q?4nWYtaATWtwIbVdQTSLFXknK3lv/5Tkl6H7tYdRFUkBWK0/vwP4jpgHffhPi?= =?us-ascii?Q?v62gIAY1Myx5nlo/iDGIfr0N90I9mM9X7BuSQTj/Nm7jUDm5o7l6q3S0O4U4?= =?us-ascii?Q?nmXavVjekkg61XQXMBJuvWuuoXAGLOvbZD3zsOu+SlXGLmy9rgo4L/ShgzSg?= =?us-ascii?Q?cnIy4sovi5mY6PuVXFMNw/Gz7uTKXBXDeLWgF/C2YnUJVwzWI01BIESsaHVL?= =?us-ascii?Q?E2eYUKQeCK6WnrFyl8YDVmQME7qEDt1l9sk1Cwo8LA=3D=3D?= X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7d9f5d84-6198-4be5-9376-08dcada2a6a3 X-MS-Exchange-CrossTenant-AuthSource: GV1P250MB0737.EURP250.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jul 2024 18:42:07.5519 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P250MB0268 Subject: [FFmpeg-devel] [PATCH] avcodec/vp8: Maintain consistency of frame pointers X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: Right now it is possible for the pointer for the current frame to be set in the context even when it could not be properly set up; this does not influence various the ordinary ref frames, but only VP8Context.prev_frame. And since this code has been ported to the ProgressFrame API in d48d7bc434f30dfbdf346f16715e4f2044b3e000, this leads to segfaults, because the ProgressFrame API is less forgiving than the ThreadFrame API (waiting on an uninitialized ProgressFrame segfaults, waiting on an uninitialized ThreadFrame is a no-op (the code behaves as if frame-threading is not in use)). Fix this by maintaining the consistency of the frame pointers in the context (by setting them later). Fixes: NULL pointer dereference Fixes: 68192/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP8_fuzzer-6180311026171904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Andreas Rheinhardt --- libavcodec/vp8.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c index d6df018655..8945447eb6 100644 --- a/libavcodec/vp8.c +++ b/libavcodec/vp8.c @@ -541,9 +541,12 @@ static int vp7_fade_frame(VP8Context *s, int alpha, int beta) /* preserve the golden frame, write a new previous frame */ if (s->framep[VP8_FRAME_GOLDEN] == s->framep[VP8_FRAME_PREVIOUS]) { - s->framep[VP8_FRAME_PREVIOUS] = vp8_find_free_buffer(s); - if ((ret = vp8_alloc_frame(s, s->framep[VP8_FRAME_PREVIOUS], 1)) < 0) + VP8Frame *prev_frame = vp8_find_free_buffer(s); + + ret = vp8_alloc_frame(s, prev_frame, 1); + if (ret < 0) return ret; + s->framep[VP8_FRAME_PREVIOUS] = prev_frame; dst = s->framep[VP8_FRAME_PREVIOUS]->tf.f; @@ -2699,7 +2702,7 @@ int vp78_decode_frame(AVCodecContext *avctx, AVFrame *rframe, int *got_frame, &s->frames[i] != s->framep[VP8_FRAME_ALTREF]) vp8_release_frame(&s->frames[i]); - curframe = s->framep[VP8_FRAME_CURRENT] = vp8_find_free_buffer(s); + curframe = vp8_find_free_buffer(s); if (!s->colorspace) avctx->colorspace = AVCOL_SPC_BT470BG; @@ -2723,6 +2726,7 @@ int vp78_decode_frame(AVCodecContext *avctx, AVFrame *rframe, int *got_frame, if ((ret = vp8_alloc_frame(s, curframe, referenced)) < 0) goto err; + s->framep[VP8_FRAME_CURRENT] = curframe; if (s->keyframe) curframe->tf.f->flags |= AV_FRAME_FLAG_KEY; else -- 2.40.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".