Closed
Bug 1479669
Opened 6 years ago
Closed 6 years ago
OpenH264: member access within null pointer of type 'struct SPicture' in codec/decoder/core/src/mv_pred.cpp
Categories
(Core :: Audio/Video: GMP, defect)
Core
Audio/Video: GMP
Tracking
()
RESOLVED
FIXED
People
(Reporter: tsmith, Unassigned)
References
Details
(Keywords: crash, csectype-nullptr, testcase)
Attachments
(1 file)
193 bytes,
application/octet-stream
|
Details |
Found while fuzzing openh264 revision f92a006bb05dce89f312df8a641a65abf09076c8 Build with "-fsanitize=undefined" To reproduce: ./h264dec testcase.264 /dev/null codec/decoder/core/src/mv_pred.cpp:316:35: runtime error: member access within null pointer of type 'struct SPicture' #0 0x6fbd80 in WelsDec::GetColocatedMb(WelsDec::TagWelsDecoderContext*, unsigned int&, unsigned int&) codec/decoder/core/src/mv_pred.cpp:316:35 #1 0x6fca2c in WelsDec::PredMvBDirectSpatial(WelsDec::TagWelsDecoderContext*, short (*) [2], signed char*) codec/decoder/core/src/mv_pred.cpp:380:3 #2 0x6d35a4 in WelsDec::WelsDecodeMbCabacBSlice(WelsDec::TagWelsDecoderContext*, WelsDec::TagNalUnit*, unsigned int&) codec/decoder/core/src/decode_slice.cpp:1421:7 #3 0x6d8425 in WelsDec::WelsDecodeSlice(WelsDec::TagWelsDecoderContext*, bool, WelsDec::TagNalUnit*) codec/decoder/core/src/decode_slice.cpp:1555:12 #4 0x59adc4 in WelsDec::DecodeCurrentAccessUnit(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*) codec/decoder/core/src/decoder_core.cpp:2549:16 #5 0x595d93 in WelsDec::ConstructAccessUnit(WelsDec::TagWelsDecoderContext*, unsigned char**, TagBufferInfo*) codec/decoder/core/src/decoder_core.cpp:2252:10 #6 0x55a69e in WelsDecodeBs codec/decoder/core/src/decoder.cpp:798:7 #7 0x52e365 in WelsDec::CWelsDecoder::DecodeFrame2(unsigned char const*, int, unsigned char**, TagBufferInfo*) codec/decoder/plus/src/welsDecoderExt.cpp:570:3 #8 0x52c4f4 in WelsDec::CWelsDecoder::DecodeFrameNoDelay(unsigned char const*, int, unsigned char**, TagBufferInfo*) codec/decoder/plus/src/welsDecoderExt.cpp:495:11 #9 0x516b49 in H264DecodeInstance(ISVCDecoder*, char const*, char const*, int&, int&, char const*, char const*, int, bool) codec/console/dec/src/h264dec.cpp:226:17 #10 0x51c34f in main codec/console/dec/src/h264dec.cpp:510:3 #11 0x7fb57cbdd82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 #12 0x41d638 in _start (h264dec+0x41d638)
Reporter | ||
Updated•6 years ago
|
Group: media-core-security
Comment 1•6 years ago
|
||
The issue has been addressed by openh264 #PR 3011
Reporter | ||
Comment 2•6 years ago
|
||
Verified with commit 1b3980b3437e83f30001e9b7dfdf4a98e69b87bc
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Assignee | ||
Updated•2 years ago
|
Component: OpenH264 → Audio/Video: GMP
Product: External Software Affecting Firefox → Core
You need to log in
before you can comment on or make changes to this bug.
Description
•