From patchwork Thu Feb 8 21:16:23 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frank Plowman X-Patchwork-Id: 46118 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a05:6a21:a586:b0:19e:8a94:b663 with SMTP id gd6csp545239pzc; Thu, 8 Feb 2024 13:16:42 -0800 (PST) X-Forwarded-Encrypted: i=2; AJvYcCUrDEqMqZhJ5HH/sTImA2vXhJ1gD1N+7NdGeAeqcxRrYuNZfWUJa6cugj09BnlJ8j12lHd6tYrOx1JpvpZ9J96PdGWo766c3SS0kA== X-Google-Smtp-Source: AGHT+IHjv1PoshGBcy9OPcD2iB/qrB8bQy5ac3U+Vbka67Pcnck0BQV4K1O30QwvJ0rrYM66BURP X-Received: by 2002:a50:9b18:0:b0:561:aa3:ef06 with SMTP id o24-20020a509b18000000b005610aa3ef06mr269244edi.3.1707427001997; Thu, 08 Feb 2024 13:16:41 -0800 (PST) X-Forwarded-Encrypted: i=2; AJvYcCVjuJdHC1JfTs13Hzd5Fj1fkFHiL7aAOgejIoMhStybHrrUCtzJIyOSK9Yi0Iw5dqqQczLPYZxOj9/HoeP6dry4pCRAz1WWHAGM2wJDfVQUcv9Ti68/kBJWjGTJQmBPEo7B9mXRJwynGEIXKvf4F+vwH/qcRFg5GcJ9uB8oVhaBUjEvbHCp7hiCPPzII13SUYoNaEv4X1eilBU2bAe5tJOFxPNZx/PJ+Gu8rXw9AVpeWW+aAjDEIbQq3aqPtU6CeH8cSftYpYzv5Evt+essBfmNwkGQnIGbnlqeQv+wR8zJ6Bmao6fg60GNK3za3F73I0pa6DNBP+k2lAVA0/9pnNGFVqu1h6AwfWomE0VI/38j8EaUOF02U/ryE/gHGy2enB3Y2Cbn+sb3EA6VxKw/weqLdqeydVGk2o9Pi3ih1dJlJpWzt7g6Ib4aNFOO/Ymfp7ZtDkkJCqcyfq0cIsZW2yCZYSW4XyLUqqujkLPoxTjxwrCAt+qRCDxff0H40zCya20fdCPXMephYcuzPGMF2R9gWkzMWnCBjHZOdV5L0E8XHBfKMfMpc4uF7wdkUgd9lvRmAkLYqLsrpaf4aiefK/dxlQxHk6PXbMEhIFBHDXIB8mGRCV6WZ/8rjVgUSqOIUfj0wdp8yRW47ACrxsAiJEBYxrXlP7pgIdQrs/1qOgcu3+E4F5aNvLN87mzMcdrnUTY5uTdu0ldJ/DBMp5vqAFGhiSgvHswZHs+so5PAMRfSkAYE4t2VJEizw9oqU6DtjXCRDzmzWKNG7621wP8eqEzAqNBh+asxN8AmSo2yuAf99YIF38jjPh57efhANv/oz62sP+MVx3OGIlrcLUUs++FhQayoLluMZwXF1tlojNwYj0IUD5CPu/hE2BaiLG17qi37EU/1OxEcnqtRhxuapIEOl0UIQgCncZrL8MKTU1HkHotMALaF94D7APgQi9Pp2U/V75 0LiL+fvohk/1ki1sFwxUXowNujNkdMxmR4vHE7u8iar0BCtTIEJQJeK5Da5gmYH6L+fVqXmC0LB8izYLrWewwb/5lIA4KqoCtsveS/Qp5u/uLt3qvhwPOwqCIRyGtngJGEbkwvQYdwIxLDhUArjcJRFunVM5rL1OAeR/VffJXxvDXFGo/7lelJuLNkitw66XJComK+tu2u96WUL533lXG3MA26FNv/jJkT27JZ9+kspWnXvvaf/457UHRHIvtYjGBoffHIP/XzNVLA17n4HjvdMZ9+zUXrYbDwJS0JzkI/E4k7XvUBbHWn3uPoVfCfwIUGem4FTdfJe5OpOVMyOM4GTHKQ0FqkAvNaICyAkbc24uUcNiz7NFar+7Ngu5NnFvfXkpKVP7fhZc+YGt/oQ5Y5MbEgOVTGkrO3dSl/N7+uU4XvF2cucFhnwnSOzGlROnA9Q5PTxEP8LeNQxNe3oo+/L9lGCNftb3xzUh9XwluT0Wlca68JR4/CwNg0OxqW0zKKXINUoITaWaCfcLBDoEIz9XjJPdDUt5PmQmw5sUu4kt8eaLr+dbSkHmO3ycpJp06Hjwh7YwYeI3XeWCTqAsjLuegC84g= Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id bx27-20020a0564020b5b00b00560c0da43c7si111549edb.101.2024.02.08.13.16.41; Thu, 08 Feb 2024 13:16:41 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@frankplowman.com header.s=zmail header.b=ZdbECdpO; arc=fail (body hash mismatch); spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 58D0D68D17D; Thu, 8 Feb 2024 23:16:38 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from sender11-op-o12.zoho.eu (sender11-op-o12.zoho.eu [31.186.226.226]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id F1DCA68D0F2 for ; Thu, 8 Feb 2024 23:16:31 +0200 (EET) Delivered-To: post@frankplowman.com ARC-Seal: i=1; a=rsa-sha256; t=1707426988; cv=none; d=zohomail.eu; s=zohoarc; b=MgrvCqytQ8IPhXacY7T+qq/RDiXxYBUpYPlDKMvSMPDOVskgm7cjsMHTY4ySTzPa2U49lxOVI1yrabFZp9jTWfeqOxdUF5Y7/5DKCq+ZniA4DUpHeJBaMG7XLr7iJ+lhfW9onew6mj8unicbCu+Zjul/5OMao+tFb3uM3msZnvY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1707426988; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=7G1V1/j+eE/xJC3ivBx8u/5KphlGeYr8hEo0cWCq1X4=; b=EVRytXgPx5QOgoFEJkgCCknfjJj9tkNDDxmNhLVJE188ks3sHezxOEGxAKr9qqSMERUa1LJyGd5rOGEQFrrywDvE/21o62kMqFi6IdlcctQ0gd8qFuyiob5BSIie5U60MsO3DQUpEItBmCu7SOAhoOfWubF8NySLszpeUSu3oRE= ARC-Authentication-Results: i=1; mx.zohomail.eu; dkim=pass header.i=frankplowman.com; spf=pass smtp.mailfrom=post@frankplowman.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1707426988; s=zmail; d=frankplowman.com; i=post@frankplowman.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=7G1V1/j+eE/xJC3ivBx8u/5KphlGeYr8hEo0cWCq1X4=; b=ZdbECdpOSL31Gu017gGraG6j53ASzRc5bc4pn6MNDyYSnvk2Mt0s7eL5B8LwxAKM SfnGQOGZXKjO2moorTo9M8P159ulGfRUpx5drulxRQJcDPdqAtZKQbQNdn5WRv+Mwou X392C/ACvxadvqVnaQsVOFy3POCynrfl7BGmKrTo= Received: from localhost.localdomain (78.32.118.75 [78.32.118.75]) by mx.zoho.eu with SMTPS id 170742698722298.37319364131736; Thu, 8 Feb 2024 22:16:27 +0100 (CET) From: post@frankplowman.com To: ffmpeg-devel@ffmpeg.org Date: Thu, 8 Feb 2024 21:16:23 +0000 Message-ID: <20240208211623.74716-1-post@frankplowman.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-ZohoMailClient: External Subject: [FFmpeg-devel] [PATCH] lavc/vvc: Check fc->ref contains valid reference X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Frank Plowman Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: 52OoDI8amYju From: Frank Plowman Depending on where exactly decode_nal_unit failed, it is possible that fc->ref holds a VVCFrame which has had ff_vvc_unref_frame called on it and not yet had ref_frame called on it. In this case, fc->ref most of the fields of fc->ref are NULL and attempting to call ff_vvc_report_frame_finished on it will result in a null dereference. Patch fixes the error described above by checking fc->ref has not only been allocated, but also references a valid AVFrame before attempting to call ff_vvc_report_frame_finished on it. Signed-off-by: Frank Plowman --- libavcodec/vvc/vvcdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/vvc/vvcdec.c b/libavcodec/vvc/vvcdec.c index 8163b5ecb6..246ee79299 100644 --- a/libavcodec/vvc/vvcdec.c +++ b/libavcodec/vvc/vvcdec.c @@ -820,7 +820,7 @@ static int decode_nal_units(VVCContext *s, VVCFrameContext *fc, AVPacket *avpkt) return 0; fail: - if (fc->ref) + if (fc->ref && fc->ref->frame->buf[0]) ff_vvc_report_frame_finished(fc->ref); return ret; }