Closed Bug 1479669 Opened 6 years ago Closed 6 years ago

OpenH264: member access within null pointer of type 'struct SPicture' in codec/decoder/core/src/mv_pred.cpp

Categories

(Core :: Audio/Video: GMP, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: tsmith, Unassigned)

References

Details

(Keywords: crash, csectype-nullptr, testcase)

Attachments

(1 file)

193 bytes, application/octet-stream
Details
Attached file testcase.264
Found while fuzzing openh264 revision f92a006bb05dce89f312df8a641a65abf09076c8

Build with "-fsanitize=undefined"

To reproduce:
./h264dec testcase.264 /dev/null

codec/decoder/core/src/mv_pred.cpp:316:35: runtime error: member access within null pointer of type 'struct SPicture'
    #0 0x6fbd80 in WelsDec::GetColocatedMb(WelsDec::TagWelsDecoderContext*, unsigned int&, unsigned int&) codec/decoder/core/src/mv_pred.cpp:316:35
    #1 0x6fca2c in WelsDec::PredMvBDirectSpatial(WelsDec::TagWelsDecoderContext*, short (*) [2], signed char*) codec/decoder/core/src/mv_pred.cpp:380:3
    #2 0x6d35a4 in WelsDec::WelsDecodeMbCabacBSlice(WelsDec::TagWelsDecoderContext*, WelsDec::TagNalUnit*, unsigned int&) codec/decoder/core/src/decode_slice.cpp:1421:7
    #3 0x6d8425 in WelsDec::WelsDecodeSlice(WelsDec::TagWelsDecoderContext*, bool, WelsDec::TagNalUnit*) codec/decoder/core/src/decode_slice.cpp:1555:12
    #4 0x59adc4 in WelsDec::DecodeCurrentAccessUnit(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*) codec/decoder/core/src/decoder_core.cpp:2549:16
    #5 0x595d93 in WelsDec::ConstructAccessUnit(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*) codec/decoder/core/src/decoder_core.cpp:2252:10
    #6 0x55a69e in WelsDecodeBs codec/decoder/core/src/decoder.cpp:798:7
    #7 0x52e365 in WelsDec::CWelsDecoder::DecodeFrame2(unsigned char const*, int, unsigned char**, TagBufferInfo*) codec/decoder/plus/src/welsDecoderExt.cpp:570:3
    #8 0x52c4f4 in WelsDec::CWelsDecoder::DecodeFrameNoDelay(unsigned char const*, int, unsigned char**, TagBufferInfo*) codec/decoder/plus/src/welsDecoderExt.cpp:495:11
    #9 0x516b49 in H264DecodeInstance(ISVCDecoder*, char const*, char const*, int&, int&, char const*, char const*, int, bool) codec/console/dec/src/h264dec.cpp:226:17
    #10 0x51c34f in main codec/console/dec/src/h264dec.cpp:510:3
    #11 0x7fb57cbdd82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #12 0x41d638 in _start (h264dec+0x41d638)
Group: media-core-security
Blocks: 1481142
The issue has been addressed by openh264 #PR 3011
Verified with commit 1b3980b3437e83f30001e9b7dfdf4a98e69b87bc
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
No longer blocks: 1481142
Blocks: 1486988
Blocks: 1512756
No longer blocks: 1486988
Component: OpenH264 → Audio/Video: GMP
Product: External Software Affecting Firefox → Core
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: