| Message ID | 20231006110134.1186-1-d.kozinski@samsung.com |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,v1] avcodec/vp9_superframe_split_bsf: Fix for possible null pointer dereference | expand |
Pointer ctx->priv_data->buffer_pkt->data, that can have only NULL value (checked at vp9_superframe_split_bsf.c:48), is dereferenced at vp9_superframe_split_bsf.c:57. > -----Original Message----- > From: Dawid Kozinski <d.kozinski@samsung.com> > Sent: piątek, 6 października 2023 13:02 > To: d.frankiewic@samsung.com; ffmpeg-devel@ffmpeg.org > Cc: Dawid Kozinski <d.kozinski@samsung.com> > Subject: [PATCH v1] avcodec/vp9_superframe_split_bsf: Fix for possible null > pointer dereference > > Signed-off-by: Dawid Kozinski <d.kozinski@samsung.com> > --- > libavcodec/vp9_superframe_split_bsf.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/vp9_superframe_split_bsf.c > b/libavcodec/vp9_superframe_split_bsf.c > index cddd48119c..4f94afc6d9 100644 > --- a/libavcodec/vp9_superframe_split_bsf.c > +++ b/libavcodec/vp9_superframe_split_bsf.c > @@ -45,7 +45,7 @@ static int vp9_superframe_split_filter(AVBSFContext *ctx, > AVPacket *out) > int i, j, ret, marker; > int is_superframe = !!s->buffer_pkt->data; > > - if (!s->buffer_pkt->data) { > + if (s->buffer_pkt->data) { > ret = ff_bsf_get_packet_ref(ctx, s->buffer_pkt); > if (ret < 0) > return ret; > -- > 2.25.1
Dawid Kozinski/Multimedia (PLT) /SRPOL/Staff Engineer/Samsung Electronics: > > Pointer ctx->priv_data->buffer_pkt->data, that can have only NULL value (checked at vp9_superframe_split_bsf.c:48), is dereferenced at vp9_superframe_split_bsf.c:57. > The rationale for a patch should be included in the commit message and not be sent as a reply to the actual patch. The warning is nonsense and you are breaking the whole BSF with this patch. It is perfectly normal for buffer_pkt->data to be NULL at line 48 and to be != NULL at line 57: There is a ff_bsf_get_packet_ref() in between which fills the packet. - Andreas > >> -----Original Message----- >> From: Dawid Kozinski <d.kozinski@samsung.com> >> Sent: piątek, 6 października 2023 13:02 >> To: d.frankiewic@samsung.com; ffmpeg-devel@ffmpeg.org >> Cc: Dawid Kozinski <d.kozinski@samsung.com> >> Subject: [PATCH v1] avcodec/vp9_superframe_split_bsf: Fix for possible null >> pointer dereference >> >> Signed-off-by: Dawid Kozinski <d.kozinski@samsung.com> >> --- >> libavcodec/vp9_superframe_split_bsf.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/libavcodec/vp9_superframe_split_bsf.c >> b/libavcodec/vp9_superframe_split_bsf.c >> index cddd48119c..4f94afc6d9 100644 >> --- a/libavcodec/vp9_superframe_split_bsf.c >> +++ b/libavcodec/vp9_superframe_split_bsf.c >> @@ -45,7 +45,7 @@ static int vp9_superframe_split_filter(AVBSFContext *ctx, >> AVPacket *out) >> int i, j, ret, marker; >> int is_superframe = !!s->buffer_pkt->data; >> >> - if (!s->buffer_pkt->data) { >> + if (s->buffer_pkt->data) { >> ret = ff_bsf_get_packet_ref(ctx, s->buffer_pkt); >> if (ret < 0) >> return ret; >> -- >> 2.25.1 > >
Oops, you're absolutely right. I can't believe I missed ff_bsf_get_packet_ref. My apologies for the false alarm. It's a lesson for me to be more attentive. Dawid > -----Original Message----- > From: ffmpeg-devel <ffmpeg-devel-bounces@ffmpeg.org> On Behalf Of > Andreas Rheinhardt > Sent: piątek, 6 października 2023 15:11 > To: ffmpeg-devel@ffmpeg.org > Subject: Re: [FFmpeg-devel] [PATCH v1] avcodec/vp9_superframe_split_bsf: Fix > for possible null pointer dereference > > Dawid Kozinski/Multimedia (PLT) /SRPOL/Staff Engineer/Samsung Electronics: > > > > Pointer ctx->priv_data->buffer_pkt->data, that can have only NULL value > (checked at vp9_superframe_split_bsf.c:48), is dereferenced at > vp9_superframe_split_bsf.c:57. > > > > The rationale for a patch should be included in the commit message and not be > sent as a reply to the actual patch. > > The warning is nonsense and you are breaking the whole BSF with this patch. It is > perfectly normal for buffer_pkt->data to be NULL at line 48 and to be != NULL at > line 57: There is a ff_bsf_get_packet_ref() in between which fills the packet. > > - Andreas > > > > >> -----Original Message----- > >> From: Dawid Kozinski <d.kozinski@samsung.com> > >> Sent: piątek, 6 października 2023 13:02 > >> To: d.frankiewic@samsung.com; ffmpeg-devel@ffmpeg.org > >> Cc: Dawid Kozinski <d.kozinski@samsung.com> > >> Subject: [PATCH v1] avcodec/vp9_superframe_split_bsf: Fix for > >> possible null pointer dereference > >> > >> Signed-off-by: Dawid Kozinski <d.kozinski@samsung.com> > >> --- > >> libavcodec/vp9_superframe_split_bsf.c | 2 +- > >> 1 file changed, 1 insertion(+), 1 deletion(-) > >> > >> diff --git a/libavcodec/vp9_superframe_split_bsf.c > >> b/libavcodec/vp9_superframe_split_bsf.c > >> index cddd48119c..4f94afc6d9 100644 > >> --- a/libavcodec/vp9_superframe_split_bsf.c > >> +++ b/libavcodec/vp9_superframe_split_bsf.c > >> @@ -45,7 +45,7 @@ static int vp9_superframe_split_filter(AVBSFContext > >> *ctx, AVPacket *out) > >> int i, j, ret, marker; > >> int is_superframe = !!s->buffer_pkt->data; > >> > >> - if (!s->buffer_pkt->data) { > >> + if (s->buffer_pkt->data) { > >> ret = ff_bsf_get_packet_ref(ctx, s->buffer_pkt); > >> if (ret < 0) > >> return ret; > >> -- > >> 2.25.1 > > > > > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://protect2.fireeye.com/v1/url?k=17d2741b-76af9c5c-17d3ff54- > 74fe485fff30-c67cc2f5726cb1a6&q=1&e=84d99260-3508-4d83-bca4- > 3e475cf427c4&u=https%3A%2F%2Fffmpeg.org%2Fmailman%2Flistinfo%2Fffmp > eg-devel > > To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org > with subject "unsubscribe".
diff --git a/libavcodec/vp9_superframe_split_bsf.c b/libavcodec/vp9_superframe_split_bsf.c index cddd48119c..4f94afc6d9 100644 --- a/libavcodec/vp9_superframe_split_bsf.c +++ b/libavcodec/vp9_superframe_split_bsf.c @@ -45,7 +45,7 @@ static int vp9_superframe_split_filter(AVBSFContext *ctx, AVPacket *out) int i, j, ret, marker; int is_superframe = !!s->buffer_pkt->data; - if (!s->buffer_pkt->data) { + if (s->buffer_pkt->data) { ret = ff_bsf_get_packet_ref(ctx, s->buffer_pkt); if (ret < 0) return ret;
Signed-off-by: Dawid Kozinski <d.kozinski@samsung.com> --- libavcodec/vp9_superframe_split_bsf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)