From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <ffmpeg-devel-bounces@ffmpeg.org>
Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100])
by master.gitmailbox.com (Postfix) with ESMTP id C202547A3C
for <ffmpegdev@gitmailbox.com>; Fri, 26 Jul 2024 18:42:18 +0000 (UTC)
Received: from [127.0.1.1] (localhost [127.0.0.1])
by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 63F4068D69B;
Fri, 26 Jul 2024 21:42:16 +0300 (EEST)
Received: from EUR05-DB8-obe.outbound.protection.outlook.com
(mail-db8eur05olkn2092.outbound.protection.outlook.com [40.92.89.92])
by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C65AB68D592
for <ffmpeg-devel@ffmpeg.org>; Fri, 26 Jul 2024 21:42:09 +0300 (EEST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=ei7STQd/u4hhcAzuIBJWFpSjscwiHLiJnUTDsJacx9TJae615SartCj2oUIoA0asGZ9EiOZy+uUbmvn9ZwHTqdvXaGDi140JWEJsCOiv7L99n5Q2x48uxPa7XDAYUcRz1EAbbB1dGnJ/T+AAKOBKXyDZnKNPQhAWMX7ib69RYm5/prpCU2f0sc6kdHcJAccenzGLVopiA9fqm+rh7wBXq+xUzqOxv3tEIXD6gZSa5cKJEih7PjcvK0aQW+mZgM8YRMY/KNb1DjeIoqRoPvXrxD7QQglaVui5szv5+htawb1TU1aHmm8PIhaJ+xY1yyoIH4ZxTuV6JsxDi8xdk56bqA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=2ktbbXFc8J43NTqTOHrhSgFzvmYGFtiHGIqd+bzBGlA=;
b=FG4ug7BRbJIdRuqh/b4aw2gH6OhlWmy9174fCWrajrMcioj9SPqJFgCeazws7smUzclvae4DC5z3PqqCYHdTqw1vkvIHhgSp1dOJpCMoCu86IqEwHw60Q9AYlIIY/cIKU2qaKIaEu93EJtNE8Hq7aivsFDxVhyhqRH2kVWgq5A+B803Vf9glJTHQCcRCN86VoUkuVdhu9t4xE7VeJknKVZpiH93cjFtfYNI8y2CjizR5Tj5Ax5l3msN8jOq1M+3yqnDR7qg0REp1wQS06TNNNWNuLbm8KZNSjohC1lNvSnvq2Jb+HZ+co4JFgflvoF35I6fdwprTmwG0WkX4kdtYlw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=2ktbbXFc8J43NTqTOHrhSgFzvmYGFtiHGIqd+bzBGlA=;
b=KeHVTFdBpdoZSK39pbL1IRT41cdhu8Kc1PCqk+M2pcef1oMzoA4o/OmA1ItgvP36YTrvJbWmzq1epwiCju+7//9VgGPpMeHsSck/yOzCrA3xpRs89+NjWbUxu+7LGr4RktQdHzifjaN1/r5JipCy7vXP931b/t8m5qc7MAHGvXxZW0sJ4gQ+NOzgE/3Oe/YxO4eLMf8nZ8hplokGjPt2Bf90vm80cgYixpZsJ4lwhftgcHajZCy8i1p4+W2xrcIgqkgaWpiztVQyGJGBVIgn8FFVnQKJvImg2P6koSOyxkXuXFDkGFEe2YOQpMbdBwXVknIyo6Cx0d2CFhkxQjjatg==
Received: from GV1P250MB0737.EURP250.PROD.OUTLOOK.COM (2603:10a6:150:8e::17)
by AS8P250MB0268.EURP250.PROD.OUTLOOK.COM (2603:10a6:20b:37f::6) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7784.29; Fri, 26 Jul
2024 18:42:07 +0000
Received: from GV1P250MB0737.EURP250.PROD.OUTLOOK.COM
([fe80::d6a1:e3af:a5f1:b614]) by GV1P250MB0737.EURP250.PROD.OUTLOOK.COM
([fe80::d6a1:e3af:a5f1:b614%2]) with mapi id 15.20.7784.017; Fri, 26 Jul 2024
18:42:07 +0000
From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
To: ffmpeg-devel@ffmpeg.org
Date: Fri, 26 Jul 2024 20:41:59 +0200
Message-ID: <GV1P250MB07375B64B29E55041F5DC6828FB42@GV1P250MB0737.EURP250.PROD.OUTLOOK.COM>
X-Mailer: git-send-email 2.40.1
X-TMN: [UnkG9YflaPEwHmRBYYJ16nFoqVGIkKUh2Lh31c1EvHI=]
X-ClientProxiedBy: ZR0P278CA0030.CHEP278.PROD.OUTLOOK.COM
(2603:10a6:910:1c::17) To GV1P250MB0737.EURP250.PROD.OUTLOOK.COM
(2603:10a6:150:8e::17)
X-Microsoft-Original-Message-ID: <20240726184159.2919893-1-andreas.rheinhardt@outlook.com>
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: GV1P250MB0737:EE_|AS8P250MB0268:EE_
X-MS-Office365-Filtering-Correlation-Id: 7d9f5d84-6198-4be5-9376-08dcada2a6a3
X-Microsoft-Antispam: BCL:0;
ARA:14566002|8060799006|19110799003|5072599006|461199028|1602099012|440099028|3412199025|4302099013|1710799026;
X-Microsoft-Antispam-Message-Info: zNi8effRkuZ5ann9mDLtshrE6ya1WX08sqRo3S7IaTWPu0ShzhAYNdWfpZmBPMt3hwDE6eQ698pvMceaVGj38Ur0kpqqasPdZANpAFcuiGngyVmb7BdPLbGNkY1fHSjq2W44P3R4x3t5yR7mjW6CCnN+zvCKQ+UukDH7eZ8TEXyRwAv3d09DpctM5NnJZKxXBf1+H2KAVOV633dwHyvdU1XurgNbt/XsrF8I64YGXlRAaQiD8iGhYvV9eI3nxLe5h0JvK0/UXH6XzJGP9vOkhgQkHfX2ar8ITkhYytjypl3PRDoTo9tEB6LDeoz/Oc4ZCSpbKi6OHdlVCOT7CcvzsVPxH8XToGQ2ggXYvQtisRwyWs2e580IMEi0DUPMXwgEdK4PMd1roJ18CydpqyhyA91EW9X30RRoy4ujZhsLWNHLbTjXAJXdJKDSQyFYJ99ppGhCBo/6HOg40gqhTQy+1ORbsfGR2FsPCOPVmjL2v2CGGU+R2bKOC6e2NGnUwzEkhbO+gp/uPZ6OzsJranL8MPhuVqz2tMcPAQ5vcuxQnsXM3K9PI03iSuJHEY5BLbq/FgnKRICuyL+xe+DF0B0RDSW7MA2HW9aQtLeKJvUwBvkKXaz7SutXx0h456a2RSucJGpZIYi0Sa9A6vBMd2PhpsO/H23i/tZOO9Ew5vR/lqeyOzrpwMkFvScf/fvKwzrRF7e9aTLBnRTIHRT3skqp+5LVCw5i6vt+O0zuTzrJiTYW7es9sj84ClBOcNE2o+UAds0/gbtbkqh487NeNp8woewhkQPAm6cIRiXm051gokoroatLzJqn7j+JPz6A3PLX
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?MJXZJwFws1AwLLS1j9H2g2tgbvQHYj63CJG1oIckSU3KvSvY9exyv0Kse5Ux?=
=?us-ascii?Q?RIkOl2BZsa1XNxRGLz/6yb+QNvmTOQwTVgVWkfqA7JOwDR9KF1jBgp2mS8Nk?=
=?us-ascii?Q?pPkk8b72zHrBT/uZ0Sc3ElcSyfZKcM0UHm6qcS2l2T8mNPkpXrTbD7BQRW5W?=
=?us-ascii?Q?GyYoWCF8igVGAR6PnYn6RNn6v67uQYn+kWcEV3eu7xe5St3TKTb5IRlrhEAk?=
=?us-ascii?Q?uU7Uag1cxIcpp6nGK0R7HK5WwXl/IhGp3oWE6Gh4yztA2tmT9u1Yw900xZCu?=
=?us-ascii?Q?yJb24aZk5+xHIQ5dcYSYzfsZaSaWefMUpBRJUZa/X7OPm1OL9/++ZNjIv+w7?=
=?us-ascii?Q?aTBkoQFLJTKd4jrDGnFTCXMSXrhFaTHOGskns4tEdZldppdQICJ2MA/l63zy?=
=?us-ascii?Q?BWtgbLJYy/fOAC/9Rm9YJddSdo2BxIECkD+D8oCysVy5LC7la7VICNJR2hth?=
=?us-ascii?Q?cs3WfCwmyHLw9dsxXMb/ZAWfeMs6hcuj0HTd2IDpqRHcia6mKbmIKy8Enwug?=
=?us-ascii?Q?Z92p1dVQQj0bKT6s5BKv0kNxnCEE1M+QEfXuCuKX0hrgS7+EX2X2GsTBEE4O?=
=?us-ascii?Q?VbIxWWoZd3mFcTrfkeaT8AdHnPguJ3CzGN1rHHXEvmRCJxQWp6o85TfLpkUu?=
=?us-ascii?Q?XdgWnasVSP7OYJ6ie25cs5AX/XgUxA7zWMgxXh0tTAocahkd4w8n2s5Q/i6s?=
=?us-ascii?Q?/c6Z+/lEEkwkeQooZoI1AMI8m5dY7ri9F0hlw3T880z0cqGOmnC1oH3LMPKl?=
=?us-ascii?Q?lDbeVS41DrZAqsZzNnqCFhdt3kidGUuYZ4CF0McyYNz/QbejtWuL57if+4hV?=
=?us-ascii?Q?jhgzrqncnL8TUenkp6w7Gd05AN9HaZ07kterk46nDpfIHEVKuJ776i4klHtz?=
=?us-ascii?Q?JxnDD9ScyLL2Sg0YQt8gfY1PDYcEdMweHTBi88yd00J1OYQNTetkRRzcLw5Q?=
=?us-ascii?Q?JoV6/p0myudLSwN2aRIixoaEoYbOG4mUUk3qLWDwzHEM0sMbk8CJaV5Pf0N1?=
=?us-ascii?Q?4nWYtaATWtwIbVdQTSLFXknK3lv/5Tkl6H7tYdRFUkBWK0/vwP4jpgHffhPi?=
=?us-ascii?Q?v62gIAY1Myx5nlo/iDGIfr0N90I9mM9X7BuSQTj/Nm7jUDm5o7l6q3S0O4U4?=
=?us-ascii?Q?nmXavVjekkg61XQXMBJuvWuuoXAGLOvbZD3zsOu+SlXGLmy9rgo4L/ShgzSg?=
=?us-ascii?Q?cnIy4sovi5mY6PuVXFMNw/Gz7uTKXBXDeLWgF/C2YnUJVwzWI01BIESsaHVL?=
=?us-ascii?Q?E2eYUKQeCK6WnrFyl8YDVmQME7qEDt1l9sk1Cwo8LA=3D=3D?=
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7d9f5d84-6198-4be5-9376-08dcada2a6a3
X-MS-Exchange-CrossTenant-AuthSource: GV1P250MB0737.EURP250.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jul 2024 18:42:07.5519 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P250MB0268
Subject: [FFmpeg-devel] [PATCH] avcodec/vp8: Maintain consistency of frame
pointers
X-BeenThere: ffmpeg-devel@ffmpeg.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: FFmpeg development discussions and patches <ffmpeg-devel.ffmpeg.org>
List-Unsubscribe: <https://ffmpeg.org/mailman/options/ffmpeg-devel>,
<mailto:ffmpeg-devel-request@ffmpeg.org?subject=unsubscribe>
List-Archive: <https://ffmpeg.org/pipermail/ffmpeg-devel>
List-Post: <mailto:ffmpeg-devel@ffmpeg.org>
List-Help: <mailto:ffmpeg-devel-request@ffmpeg.org?subject=help>
List-Subscribe: <https://ffmpeg.org/mailman/listinfo/ffmpeg-devel>,
<mailto:ffmpeg-devel-request@ffmpeg.org?subject=subscribe>
Reply-To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Cc: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: ffmpeg-devel-bounces@ffmpeg.org
Sender: "ffmpeg-devel" <ffmpeg-devel-bounces@ffmpeg.org>
Archived-At: <https://master.gitmailbox.com/ffmpegdev/GV1P250MB07375B64B29E55041F5DC6828FB42@GV1P250MB0737.EURP250.PROD.OUTLOOK.COM/>
List-Archive: <https://master.gitmailbox.com/ffmpegdev/>
List-Post: <mailto:ffmpegdev@gitmailbox.com>
Right now it is possible for the pointer for the current frame to
be set in the context even when it could not be properly set up;
this does not influence various the ordinary ref frames, but only
VP8Context.prev_frame. And since this code has been ported to the
ProgressFrame API in d48d7bc434f30dfbdf346f16715e4f2044b3e000,
this leads to segfaults, because the ProgressFrame API is less
forgiving than the ThreadFrame API (waiting on an uninitialized
ProgressFrame segfaults, waiting on an uninitialized ThreadFrame
is a no-op (the code behaves as if frame-threading is not in use)).
Fix this by maintaining the consistency of the frame pointers
in the context (by setting them later).
Fixes: NULL pointer dereference
Fixes: 68192/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP8_fuzzer-6180311026171904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
libavcodec/vp8.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c
index d6df018655..8945447eb6 100644
--- a/libavcodec/vp8.c
+++ b/libavcodec/vp8.c
@@ -541,9 +541,12 @@ static int vp7_fade_frame(VP8Context *s, int alpha, int beta)
/* preserve the golden frame, write a new previous frame */
if (s->framep[VP8_FRAME_GOLDEN] == s->framep[VP8_FRAME_PREVIOUS]) {
- s->framep[VP8_FRAME_PREVIOUS] = vp8_find_free_buffer(s);
- if ((ret = vp8_alloc_frame(s, s->framep[VP8_FRAME_PREVIOUS], 1)) < 0)
+ VP8Frame *prev_frame = vp8_find_free_buffer(s);
+
+ ret = vp8_alloc_frame(s, prev_frame, 1);
+ if (ret < 0)
return ret;
+ s->framep[VP8_FRAME_PREVIOUS] = prev_frame;
dst = s->framep[VP8_FRAME_PREVIOUS]->tf.f;
@@ -2699,7 +2702,7 @@ int vp78_decode_frame(AVCodecContext *avctx, AVFrame *rframe, int *got_frame,
&s->frames[i] != s->framep[VP8_FRAME_ALTREF])
vp8_release_frame(&s->frames[i]);
- curframe = s->framep[VP8_FRAME_CURRENT] = vp8_find_free_buffer(s);
+ curframe = vp8_find_free_buffer(s);
if (!s->colorspace)
avctx->colorspace = AVCOL_SPC_BT470BG;
@@ -2723,6 +2726,7 @@ int vp78_decode_frame(AVCodecContext *avctx, AVFrame *rframe, int *got_frame,
if ((ret = vp8_alloc_frame(s, curframe, referenced)) < 0)
goto err;
+ s->framep[VP8_FRAME_CURRENT] = curframe;
if (s->keyframe)
curframe->tf.f->flags |= AV_FRAME_FLAG_KEY;
else
--
2.40.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".