[FFmpeg-devel] [PATCH 4/8] lavc/snow: only allocate mconly_picture for decoding

[Michael Niedermayer]

On Wed, Mar 23, 2022 at 04:57:16PM +0100, Anton Khirnov wrote:
> It is not used in the encoder.
> ---
>  libavcodec/snow.c | 19 +++++++++++--------
>  1 file changed, 11 insertions(+), 8 deletions(-)

this is segfaulting with some fuzzed file
==30657== Invalid read of size 8
==30657==    at 0x1157660: ??? (libavcodec/x86/videodsp.asm:340)
==30657==    by 0xE18591: emulated_edge_mc_avx2 (videodsp_init.c:268)
==30657==    by 0x10D8973: ff_snow_pred_block (snow.c:370)
==30657==    by 0xC0E7DA: add_yblock (snow.h:345)
==30657==    by 0xC0FE62: predict_slice_buffered (snowdec.c:78)
==30657==    by 0xC12CAD: decode_frame (snowdec.c:602)
==30657==    by 0x8BF99F: decode_simple_internal (decode.c:306)
==30657==    by 0x8C0650: decode_simple_receive_frame (decode.c:514)
==30657==    by 0x8C0756: decode_receive_frame_internal (decode.c:535)
==30657==    by 0x8C0A17: avcodec_send_packet (decode.c:603)
==30657==    by 0x25D6A5: decode (ffmpeg.c:2275)
==30657==    by 0x25DE2C: decode_video (ffmpeg.c:2400)
==30657==    by 0x25EEBC: process_input_packet (ffmpeg.c:2640)
==30657==    by 0x266A1E: process_input (ffmpeg.c:4494)
==30657==    by 0x266F12: transcode_step (ffmpeg.c:4634)
==30657==    by 0x26707A: transcode (ffmpeg.c:4688)
==30657==    by 0x267AEF: main (ffmpeg.c:4904)
==30657==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Elect your leaders based on what they did after the last election, not
based on what they say before an election.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20220325/ced8e951/attachment.sig>