diff mbox series

[FFmpeg-devel,05/17] avcodec/dxva2_*: Initialize dxva_data_ptr

Message ID 20240526235230.2876318-5-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,01/17] avcodec/dxva2: Initialize dxva_size and check it | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer May 26, 2024, 11:52 p.m. UTC 
Fixes: CID1591888 Uninitialized scalar variable
Fixes: CID1591925 Uninitialized pointer read
Fixes: CID1591933 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/dxva2_av1.c   | 4 ++--
 libavcodec/dxva2_hevc.c  | 5 ++++-
 libavcodec/dxva2_mpeg2.c | 5 ++++-
 libavcodec/dxva2_vc1.c   | 5 ++++-
 libavcodec/dxva2_vp9.c   | 4 ++--
 5 files changed, 16 insertions(+), 7 deletions(-)
diff mbox series

Patch

diff --git a/libavcodec/dxva2_av1.c b/libavcodec/dxva2_av1.c
index 1b555106599..ea97fcb87e5 100644
--- a/libavcodec/dxva2_av1.c
+++ b/libavcodec/dxva2_av1.c
@@ -354,7 +354,7 @@  static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     const AV1DecContext *h = avctx->priv_data;
     AVDXVAContext *ctx = DXVA_CONTEXT(avctx);
     struct av1_dxva2_picture_context *ctx_pic = h->cur_frame.hwaccel_picture_private;
-    void     *dxva_data_ptr;
+    void     *dxva_data_ptr = NULL;
     uint8_t  *dxva_data;
     unsigned dxva_size;
     unsigned padding;
@@ -382,7 +382,7 @@  static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
 
     dxva_data = dxva_data_ptr;
 
-    if (ctx_pic->bitstream_size > dxva_size) {
+    if (!dxva_data || ctx_pic->bitstream_size > dxva_size) {
         av_log(avctx, AV_LOG_ERROR, "Bitstream size exceeds hardware buffer");
         return -1;
     }
diff --git a/libavcodec/dxva2_hevc.c b/libavcodec/dxva2_hevc.c
index 31d74a7164d..5eb166c3075 100644
--- a/libavcodec/dxva2_hevc.c
+++ b/libavcodec/dxva2_hevc.c
@@ -248,7 +248,7 @@  static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     const HEVCFrame *current_picture = h->ref;
     struct hevc_dxva2_picture_context *ctx_pic = current_picture->hwaccel_picture_private;
     DXVA_Slice_HEVC_Short *slice = NULL;
-    void     *dxva_data_ptr;
+    void     *dxva_data_ptr = NULL;
     uint8_t  *dxva_data, *current, *end;
     unsigned dxva_size;
     void     *slice_data;
@@ -278,6 +278,9 @@  static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     }
 #endif
 
+    if (!dxva_data_ptr)
+        return -1;
+
     dxva_data = dxva_data_ptr;
     current = dxva_data;
     end = dxva_data + dxva_size;
diff --git a/libavcodec/dxva2_mpeg2.c b/libavcodec/dxva2_mpeg2.c
index d31a8bb8724..5de062e5308 100644
--- a/libavcodec/dxva2_mpeg2.c
+++ b/libavcodec/dxva2_mpeg2.c
@@ -160,7 +160,7 @@  static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
         s->current_picture_ptr->hwaccel_picture_private;
     const int is_field = s->picture_structure != PICT_FRAME;
     const unsigned mb_count = s->mb_width * (s->mb_height >> is_field);
-    void     *dxva_data_ptr;
+    void     *dxva_data_ptr = NULL;
     uint8_t  *dxva_data, *current, *end;
     unsigned dxva_size;
     unsigned i;
@@ -186,6 +186,9 @@  static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     }
 #endif
 
+    if (!dxva_data_ptr)
+        return -1;
+
     dxva_data = dxva_data_ptr;
     current = dxva_data;
     end = dxva_data + dxva_size;
diff --git a/libavcodec/dxva2_vc1.c b/libavcodec/dxva2_vc1.c
index f7513b2b153..04f26ddff66 100644
--- a/libavcodec/dxva2_vc1.c
+++ b/libavcodec/dxva2_vc1.c
@@ -197,7 +197,7 @@  static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     const unsigned start_code_size = avctx->codec_id == AV_CODEC_ID_VC1 ? sizeof(start_code) : 0;
     const unsigned mb_count = s->mb_width * (s->mb_height >> v->field_mode);
     DXVA_SliceInfo *slice = NULL;
-    void     *dxva_data_ptr;
+    void     *dxva_data_ptr = NULL;
     uint8_t  *dxva_data, *current, *end;
     unsigned dxva_size;
     unsigned padding;
@@ -224,6 +224,9 @@  static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     }
 #endif
 
+    if (!dxva_data_ptr)
+        return -1;
+
     dxva_data = dxva_data_ptr;
     current = dxva_data;
     end = dxva_data + dxva_size;
diff --git a/libavcodec/dxva2_vp9.c b/libavcodec/dxva2_vp9.c
index ca8b3b136da..f4ab91c580b 100644
--- a/libavcodec/dxva2_vp9.c
+++ b/libavcodec/dxva2_vp9.c
@@ -172,7 +172,7 @@  static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     const VP9SharedContext *h = avctx->priv_data;
     AVDXVAContext *ctx = DXVA_CONTEXT(avctx);
     struct vp9_dxva2_picture_context *ctx_pic = h->frames[CUR_FRAME].hwaccel_picture_private;
-    void     *dxva_data_ptr;
+    void     *dxva_data_ptr = NULL;
     uint8_t  *dxva_data;
     unsigned dxva_size;
     unsigned padding;
@@ -200,7 +200,7 @@  static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
 
     dxva_data = dxva_data_ptr;
 
-    if (ctx_pic->slice.SliceBytesInBuffer > dxva_size) {
+    if (!dxva_data || ctx_pic->slice.SliceBytesInBuffer > dxva_size) {
         av_log(avctx, AV_LOG_ERROR, "Failed to build bitstream");
         return -1;
     }