Fixes: CID1591888 Uninitialized scalar variable
Fixes: CID1591925 Uninitialized pointer read
Fixes: CID1591933 Uninitialized scalar variable
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavcodec/dxva2_av1.c | 4 ++--
libavcodec/dxva2_hevc.c | 5 ++++-
libavcodec/dxva2_mpeg2.c | 5 ++++-
libavcodec/dxva2_vc1.c | 5 ++++-
libavcodec/dxva2_vp9.c | 4 ++--
5 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/libavcodec/dxva2_av1.c b/libavcodec/dxva2_av1.c
index 1b555106599..ea97fcb87e5 100644
--- a/libavcodec/dxva2_av1.c
+++ b/libavcodec/dxva2_av1.c
@@ -354,7 +354,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext
*avctx,
const AV1DecContext *h = avctx->priv_data;
AVDXVAContext *ctx = DXVA_CONTEXT(avctx);
struct av1_dxva2_picture_context *ctx_pic =
h->cur_frame.hwaccel_picture_private;
- void *dxva_data_ptr;
+ void *dxva_data_ptr = NULL;
uint8_t *dxva_data;
unsigned dxva_size;
unsigned padding;
@@ -382,7 +382,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext
*avctx,
dxva_data = dxva_data_ptr;
- if (ctx_pic->bitstream_size > dxva_size) {
+ if (!dxva_data || ctx_pic->bitstream_size > dxva_size) {
av_log(avctx, AV_LOG_ERROR, "Bitstream size exceeds hardware buffer");
return -1;
}
diff --git a/libavcodec/dxva2_hevc.c b/libavcodec/dxva2_hevc.c
index 31d74a7164d..5eb166c3075 100644
--- a/libavcodec/dxva2_hevc.c
+++ b/libavcodec/dxva2_hevc.c
@@ -248,7 +248,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext
*avctx,
const HEVCFrame *current_picture = h->ref;
struct hevc_dxva2_picture_context *ctx_pic =
current_picture->hwaccel_picture_private;
DXVA_Slice_HEVC_Short *slice = NULL;
- void *dxva_data_ptr;
+ void *dxva_data_ptr = NULL;
uint8_t *dxva_data, *current, *end;
unsigned dxva_size;
void *slice_data;
@@ -278,6 +278,9 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext
*avctx,
}
#endif
+ if (!dxva_data_ptr)
+ return -1;
+
dxva_data = dxva_data_ptr;
current = dxva_data;
end = dxva_data + dxva_size;
diff --git a/libavcodec/dxva2_mpeg2.c b/libavcodec/dxva2_mpeg2.c
index d31a8bb8724..5de062e5308 100644
--- a/libavcodec/dxva2_mpeg2.c
+++ b/libavcodec/dxva2_mpeg2.c
@@ -160,7 +160,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext
*avctx,
s->current_picture_ptr->hwaccel_picture_private;
const int is_field = s->picture_structure != PICT_FRAME;
const unsigned mb_count = s->mb_width * (s->mb_height >> is_field);
- void *dxva_data_ptr;
+ void *dxva_data_ptr = NULL;
uint8_t *dxva_data, *current, *end;
unsigned dxva_size;
unsigned i;
@@ -186,6 +186,9 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext
*avctx,
}
#endif
+ if (!dxva_data_ptr)
+ return -1;
+
dxva_data = dxva_data_ptr;
current = dxva_data;
end = dxva_data + dxva_size;
diff --git a/libavcodec/dxva2_vc1.c b/libavcodec/dxva2_vc1.c
index f7513b2b153..04f26ddff66 100644
--- a/libavcodec/dxva2_vc1.c
+++ b/libavcodec/dxva2_vc1.c
@@ -197,7 +197,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext
*avctx,
const unsigned start_code_size = avctx->codec_id == AV_CODEC_ID_VC1 ?
sizeof(start_code) : 0;
const unsigned mb_count = s->mb_width * (s->mb_height >> v->field_mode);
DXVA_SliceInfo *slice = NULL;
- void *dxva_data_ptr;
+ void *dxva_data_ptr = NULL;
uint8_t *dxva_data, *current, *end;
unsigned dxva_size;
unsigned padding;
@@ -224,6 +224,9 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext
*avctx,
}
#endif
+ if (!dxva_data_ptr)
+ return -1;
+
dxva_data = dxva_data_ptr;
current = dxva_data;
end = dxva_data + dxva_size;
diff --git a/libavcodec/dxva2_vp9.c b/libavcodec/dxva2_vp9.c
index ca8b3b136da..f4ab91c580b 100644
--- a/libavcodec/dxva2_vp9.c
+++ b/libavcodec/dxva2_vp9.c
@@ -172,7 +172,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext
*avctx,
const VP9SharedContext *h = avctx->priv_data;
AVDXVAContext *ctx = DXVA_CONTEXT(avctx);
struct vp9_dxva2_picture_context *ctx_pic =
h->frames[CUR_FRAME].hwaccel_picture_private;
- void *dxva_data_ptr;
+ void *dxva_data_ptr = NULL;
uint8_t *dxva_data;
unsigned dxva_size;
unsigned padding;
@@ -200,7 +200,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext
*avctx,
dxva_data = dxva_data_ptr;
- if (ctx_pic->slice.SliceBytesInBuffer > dxva_size) {
+ if (!dxva_data || ctx_pic->slice.SliceBytesInBuffer > dxva_size) {
av_log(avctx, AV_LOG_ERROR, "Failed to build bitstream");
return -1;
}
--
2.45.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
