Skip to content

decoder: avoid forming invalid pointers for I_PCM in parse-only mode - #4052

Open
Nayana-Naik73 wants to merge 1 commit into
cisco:masterfrom
Nayana-Naik73:decoder-ipcm-parseonly-ub
Open

Nayana-Naik73 wants to merge 1 commit into
cisco:masterfrom
Nayana-Naik73:decoder-ipcm-parseonly-ub

Conversation

@Nayana-Naik73

Copy link
Copy Markdown

In parse-only mode (bParseOnly, reached through DecodeParser) no reconstruction picture is allocated, so pDec->pData[0..2] are NULL. The four I_PCM macroblock handlers still computed the destination pointers up front:

codec/decoder/core/src/decode_slice.cpp:1830:50: runtime error: applying non-zero offset 16 to null pointer
    #0 WelsActualDecodeMbCavlcISlice(...) decode_slice.cpp:1830
    #1 WelsDecodeSlice(...) decode_slice.cpp
    #2 DecodeCurrentAccessUnit(...) decoder_core.cpp
    #3 WelsDecodeBs decoder.cpp
    #4 CWelsDecoder::DecodeParser(...) welsDecoderExt.cpp

pData[n] + offset on a null base is undefined behavior even though the pointers are only dereferenced inside the following if (!pCtx->pParam->bParseOnly) block. The same pattern exists in all four I_PCM paths: ParseIPCMInfoCabac (CABAC) and WelsActualDecodeMbCavlc{I,P,B}Slice (CAVLC). Moving the pointer computation inside that guard removes the UB without changing reconstruction behavior.

Reproduced with a crafted stream and with the conformance stream res/CVPCMNL1_SVA_C.264 (CAVLC I_PCM) decoded via the parse-only API under -fsanitize=undefined. Added DecoderParseSyntaxTest::TestParseOnlyIPcm, which parses CVPCMNL1_SVA_C.264 and test_cif_I_CABAC_PCM.264 in parse-only mode and covers all four sites; it trips UBSan before this change and is clean after.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant