PR #24766 opened by xiujunwang-dev URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24766 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24766.patch
Fixes [Issue #24649](https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/24649). The CAVS decoder computes source pointers from the reference frame before checking whether the frame is available. When the reference frame is missing, this performs pointer arithmetic on a NULL pointer and triggers UBSan undefined behavior. Move the existing reference-frame check before the pointer arithmetic in `mc_dir_part()`. The fix was reproduced with the PoC attached to Issue #24649 and the modified `libavcodec/cavs.o` compiles successfully. Fixes: #24649 >From c0cc6fd596ca93da1f4d921cd70b130ac03e7afb Mon Sep 17 00:00:00 2001 From: "vector.wang" <[email protected]> Date: Tue, 29 Sep 2026 01:51:44 +0800 Subject: [PATCH] avcodec/cavs: check reference frame before pointer arithmetic The CAVS motion compensation code computes source pointers before checking whether the reference frame is available. Move the existing check before the pointer arithmetic to avoid undefined behavior when a missing reference frame is encountered. Fixes: #24649 Signed-off-by: vector.wang <[email protected]> --- libavcodec/cavs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/cavs.c b/libavcodec/cavs.c index 455f3e5d9e..9b83112a06 100644 --- a/libavcodec/cavs.c +++ b/libavcodec/cavs.c @@ -393,6 +393,9 @@ static inline void mc_dir_part(AVSContext *h, AVFrame *pic, int chroma_height, qpel_mc_func *qpix_op, h264_chroma_mc_func chroma_op, cavs_vector *mv) { + if (!pic->data[0]) + return; + const int mx = mv->x + src_x_offset * 8; const int my = mv->y + src_y_offset * 8; const int luma_xy = (mx & 3) + ((my & 3) << 2); @@ -407,8 +410,6 @@ static inline void mc_dir_part(AVSContext *h, AVFrame *pic, int chroma_height, const int pic_height = 16 * h->mb_height; int emu = 0; - if (!pic->data[0]) - return; if (mx & 7) extra_width -= 3; if (my & 7) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
