diff mbox series

[FFmpeg-devel] avcodec/vvc/thread: Check frame to be non NULL

Message ID 20241014152532.78427-1-nuomi2021@gmail.com
State New
Headers show
Series [FFmpeg-devel] avcodec/vvc/thread: Check frame to be non NULL | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 fail Make fate failed

Commit Message

Nuo Mi Oct. 14, 2024, 3:25 p.m. UTC
Fixes: NULL pointer dereference
Fixes: 71303/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-4875859050168320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reported-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/vvc/dec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Nuo Mi Oct. 16, 2024, 12:20 p.m. UTC | #1
On Mon, Oct 14, 2024 at 11:25 PM Nuo Mi <nuomi2021@gmail.com> wrote:

> Fixes: NULL pointer dereference
> Fixes:
> 71303/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-4875859050168320
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Reported-by
> <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReported-by>:
> Michael Niedermayer <michael@niedermayer.cc>
>
will apply.
Thank you

> ---
>  libavcodec/vvc/dec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c
> index edf2607f50..522fa8416e 100644
> --- a/libavcodec/vvc/dec.c
> +++ b/libavcodec/vvc/dec.c
> @@ -1000,7 +1000,7 @@ static int vvc_decode_frame(AVCodecContext *avctx,
> AVFrame *output,
>      if (ret < 0)
>          return ret;
>
> -    if (!fc->ft)
> +    if (!fc->ft || !fc->ref)
>          return avpkt->size;
>
>      ret = submit_frame(s, fc, output, got_output);
> --
> 2.34.1
>
>
Nuo Mi Oct. 20, 2024, 12:40 p.m. UTC | #2
On Wed, Oct 16, 2024 at 8:20 PM Nuo Mi <nuomi2021@gmail.com> wrote:

>
>
> On Mon, Oct 14, 2024 at 11:25 PM Nuo Mi <nuomi2021@gmail.com> wrote:
>
>> Fixes: NULL pointer dereference
>> Fixes:
>> 71303/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-4875859050168320
>>
>> Found-by: continuous fuzzing process
>> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>> Reported-by
>> <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReported-by>:
>> Michael Niedermayer <michael@niedermayer.cc>
>>
> will apply.
>
merged.

> Thank you
>
>> ---
>>  libavcodec/vvc/dec.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c
>> index edf2607f50..522fa8416e 100644
>> --- a/libavcodec/vvc/dec.c
>> +++ b/libavcodec/vvc/dec.c
>> @@ -1000,7 +1000,7 @@ static int vvc_decode_frame(AVCodecContext *avctx,
>> AVFrame *output,
>>      if (ret < 0)
>>          return ret;
>>
>> -    if (!fc->ft)
>> +    if (!fc->ft || !fc->ref)
>>          return avpkt->size;
>>
>>      ret = submit_frame(s, fc, output, got_output);
>> --
>> 2.34.1
>>
>>
diff mbox series

Patch

diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c
index edf2607f50..522fa8416e 100644
--- a/libavcodec/vvc/dec.c
+++ b/libavcodec/vvc/dec.c
@@ -1000,7 +1000,7 @@  static int vvc_decode_frame(AVCodecContext *avctx, AVFrame *output,
     if (ret < 0)
         return ret;
 
-    if (!fc->ft)
+    if (!fc->ft || !fc->ref)
         return avpkt->size;
 
     ret = submit_frame(s, fc, output, got_output);