[FFmpeg-devel] [PATCH] avcodec/v210dec: Fix alignment check for AVX2

[Reimar Döffinger]

On 18.05.2019, at 12:15, Michael Niedermayer <michael at niedermayer.cc> wrote:

> On Sat, May 18, 2019 at 12:02:55PM +0200, James Darnley wrote:
>> On 2019-05-18 09:39, Michael Niedermayer wrote:
>>> Fixes: "null pointer dereference"
>>> Fixes: 14551/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_V210_fuzzer-5088609952071680
>>> 
>>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
>>> ---
>>> libavcodec/v210dec.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>> 
>>> diff --git a/libavcodec/v210dec.c b/libavcodec/v210dec.c
>>> index bc1e1d34ff..5a33d8c089 100644
>>> --- a/libavcodec/v210dec.c
>>> +++ b/libavcodec/v210dec.c
>>> @@ -104,7 +104,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
>>>         && avpkt->size - 64 >= stride * avctx->height)
>>>         psrc += 64;
>>> 
>>> -    aligned_input = !((uintptr_t)psrc & 0xf) && !(stride & 0xf);
>>> +    aligned_input = !((uintptr_t)psrc & 0x1f) && !(stride & 0x1f);
>>>     if (aligned_input != s->aligned_input) {
>>>         s->aligned_input = aligned_input;
>>>         ff_v210dec_init(s);
>>> 
>> 
>> Ah yes, that'll be needed after the recent addition of avx2.  LGTM and
>> sorry.
>> 
> 
>> I object to the commit message though because it isn't a "null pointer
>> dereference" but if that is the error as reported by the tool then keep
>> it as is.
> 
> yes, the tool(s) say things like "Null-dereference READ", "SEGV on unknown address 0x000000000000"

Is that a tool bug or are we missing something that goes on here besides the alignment?
If it's a tool bug can we try to get it fixed?
This has a big risk of wasting time if they print straight-up wrong information...