Repository navigation
decoder: avoid forming invalid pointers for I_PCM in parse-only mode - #4052
Open
Nayana-Naik73 wants to merge 1 commit into
Open
Nayana-Naik73 wants to merge 1 commit into
Nayana-Naik73 wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In parse-only mode (
bParseOnly, reached throughDecodeParser) no reconstruction picture is allocated, sopDec->pData[0..2]are NULL. The four I_PCM macroblock handlers still computed the destination pointers up front:pData[n] + offseton a null base is undefined behavior even though the pointers are only dereferenced inside the followingif (!pCtx->pParam->bParseOnly)block. The same pattern exists in all four I_PCM paths:ParseIPCMInfoCabac(CABAC) andWelsActualDecodeMbCavlc{I,P,B}Slice(CAVLC). Moving the pointer computation inside that guard removes the UB without changing reconstruction behavior.Reproduced with a crafted stream and with the conformance stream
res/CVPCMNL1_SVA_C.264(CAVLC I_PCM) decoded via the parse-only API under-fsanitize=undefined. AddedDecoderParseSyntaxTest::TestParseOnlyIPcm, which parsesCVPCMNL1_SVA_C.264andtest_cif_I_CABAC_PCM.264in parse-only mode and covers all four sites; it trips UBSan before this change and is clean after.