[FFmpeg-devel] [PATCH] avcodec/ffv1enc: Use dummies to avoid UB pointer arithmetic

[FFmpeg-devel] [PATCH] avcodec/ffv1enc: Use dummies to avoid UB pointer arithmetic

[Andreas Rheinhardt]

[-- Attachment #1: Type: text/plain, Size: 27 bytes --]

Patch attached.

- Andreas

[-- Attachment #2: 0001-avcodec-ffv1enc-Use-dummies-to-avoid-UB-pointer-arit.patch --]
[-- Type: text/x-patch, Size: 2445 bytes --]

From 74609d43bdce4556651e033ce4ee8fcb022d3c95 Mon Sep 17 00:00:00 2001
From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Date: Sun, 22 Jun 2025 23:25:34 +0200
Subject: [PATCH] avcodec/ffv1enc: Use dummies to avoid UB pointer arithmetic

Fixes the following FATE-tests when run under Clang-UBSan:
ffmpeg-loopback-decoding, lavf-mxf_ffv1,
vsynth{1,2,3,_lena}-ffv1-v{0,2}, vsynth1-ffv{1,2,3,_lena},
vsynth{1,2,3,_lena}-ffv1-v3-yuv{420p,422p10,444p16}

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavcodec/ffv1enc.c          | 5 +++++
 libavcodec/ffv1enc_template.c | 5 ++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 463f46e091..cc3a04903f 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -281,6 +281,8 @@ static int encode_plane(FFV1Context *f, FFV1SliceContext *sc,
     int16_t *sample[3];
     sc->run_index = 0;
 
+    sample[2] = sc->sample_buffer; // dummy to avoid UB pointer arithmetic
+
     memset(sc->sample_buffer, 0, ring_size * (w + 6) * sizeof(*sc->sample_buffer));
 
     for (y = 0; y < h; y++) {
@@ -1509,6 +1511,9 @@ static int encode_float32_rgb_frame(FFV1Context *f, FFV1SliceContext *sc,
 
     sc->run_index = 0;
 
+    for (int p = 0; p < MAX_PLANES; ++p)
+        sample[p][2] = sc->sample_buffer32; // dummy to avoid UB pointer arithmetic
+
     memset(RENAME(sc->sample_buffer), 0, ring_size * MAX_PLANES *
            (w + 6) * sizeof(*RENAME(sc->sample_buffer)));
 
diff --git a/libavcodec/ffv1enc_template.c b/libavcodec/ffv1enc_template.c
index aaf82159ee..0178c398e5 100644
--- a/libavcodec/ffv1enc_template.c
+++ b/libavcodec/ffv1enc_template.c
@@ -25,7 +25,7 @@
 static av_always_inline int
 RENAME(encode_line)(FFV1Context *f, FFV1SliceContext *sc,
                     void *logctx,
-                    int w, TYPE *sample[3], int plane_index, int bits,
+                    int w, TYPE *const sample[3], int plane_index, int bits,
                     int ac, int pass1)
 {
     PlaneContext *const p = &sc->plane[plane_index];
@@ -189,6 +189,9 @@ static int RENAME(encode_rgb_frame)(FFV1Context *f, FFV1SliceContext *sc,
 
     sc->run_index = 0;
 
+    for (int p = 0; p < MAX_PLANES; ++p)
+        sample[p][2] = RENAME(sc->sample_buffer);
+
     memset(RENAME(sc->sample_buffer), 0, ring_size * MAX_PLANES *
            (w + 6) * sizeof(*RENAME(sc->sample_buffer)));
 
-- 
2.45.2


[-- Attachment #3: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".