History

avcodec/ffv1enc: Use dummies to avoid UB pointer arithmetic

Fixes the following FATE-tests when run under Clang-UBSan: ffmpeg-loopback-decoding, lavf-mxf_ffv1, vsynth{1,2,3,_lena}-ffv1-v{0,2}, vsynth1-ffv{1,2,3,_lena}, vsynth{1,2,3,_lena}-ffv1-v3-yuv{420p,422p10,444p16}

Andreas Rheinhardt committed 1 year ago

Commit bdb4cd41 parent 134c1d82 files · +9 −1Browse files

Showing the changes to libavcodec (2 of 2 files). Show all

Unified · Split

2 files
  1. libavcodec/ffv1enc.c +5 −0
  2. libavcodec/ffv1enc_template.c +4 −1
libavcodec/ffv1enc.c+5−0
@@ -281,6 +281,8 @@ static int encode_plane(FFV1Context *f, FFV1SliceContext *sc, · 280 unmodified lines
281281 int16_t *sample[3];
282282 sc->run_index = 0;
283283
284+ sample[2] = sc->sample_buffer; // dummy to avoid UB pointer arithmetic
285+
284286 memset(sc->sample_buffer, 0, ring_size * (w + 6) * sizeof(*sc->sample_buffer));
285287
286288 for (y = 0; y < h; y++) {
@@ -1509,6 +1511,9 @@ static int encode_float32_rgb_frame(FFV1Context *f, FFV1SliceContext *sc, · 1222 unmodified lines
15091511
15101512 sc->run_index = 0;
15111513
1514+ for (int p = 0; p < MAX_PLANES; ++p)
1515+ sample[p][2] = sc->sample_buffer32; // dummy to avoid UB pointer arithmetic
1516+
15121517 memset(RENAME(sc->sample_buffer), 0, ring_size * MAX_PLANES *
15131518 (w + 6) * sizeof(*RENAME(sc->sample_buffer)));
15141519
libavcodec/ffv1enc_template.c+4−1
@@ -25,7 +25,7 @@ · 24 unmodified lines
2525 static av_always_inline int
2626 RENAME(encode_line)(FFV1Context *f, FFV1SliceContext *sc,
2727 void *logctx,
28− int w, TYPE *sample[3], int plane_index, int bits,
28+ int w, TYPE *const sample[3], int plane_index, int bits,
2929 int ac, int pass1)
3030 {
3131 PlaneContext *const p = &sc->plane[plane_index];
@@ -189,6 +189,9 @@ static int RENAME(encode_rgb_frame)(FFV1Context *f, FFV1SliceContext *sc, · 157 unmodified lines
189189
190190 sc->run_index = 0;
191191
192+ for (int p = 0; p < MAX_PLANES; ++p)
193+ sample[p][2] = RENAME(sc->sample_buffer);
194+
192195 memset(RENAME(sc->sample_buffer), 0, ring_size * MAX_PLANES *
193196 (w + 6) * sizeof(*RENAME(sc->sample_buffer)));
194197

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t