Skip to content

oss-fuzz: Add a test case for sbh change in frame allocations

=================================================================
==59763==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62c000027a40 at pc 0x000100ccd5e3 bp 0x700008ffd670 sp 0x700008ffce38
WRITE of size 320 at 0x62c000027a40 thread T4
    #0 0x100ccd5e2 in __asan_memcpy+0x262 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x465e2)
    #1 0x100ab1e4c in backup_lpf lr_apply_tmpl.c:96
    #2 0x100ab11c1 in dav1d_lr_copy_lpf_16bpc lr_apply_tmpl.c:148
    #3 0x100b01573 in dav1d_filter_sbrow_deblock_rows_16bpc recon_tmpl.c:2076
    #4 0x100b15984 in dav1d_worker_task thread_task.c:602
    #5 0x7fff2060b953 in _pthread_start+0xdf (libsystem_pthread.dylib:x86_64+0x6953)
    #6 0x7fff206074a6 in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x24a6)

0x62c000027a40 is located 0 bytes to the right of 30784-byte region [0x62c000020200,0x62c000027a40)
allocated by thread T1 here:
    #0 0x100ccfb73 in wrap_posix_memalign+0xb3 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x48b73)
    #1 0x10091a0bf in dav1d_alloc_aligned mem.h:66
    #2 0x100914ff0 in dav1d_decode_frame_init decode.c:3090
    #3 0x100b12d9d in dav1d_worker_task thread_task.c:496
    #4 0x7fff2060b953 in _pthread_start+0xdf (libsystem_pthread.dylib:x86_64+0x6953)
    #5 0x7fff206074a6 in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x24a6)

Thread T4 created by T0 here:
    #0 0x100cc958a in wrap_pthread_create+0x5a (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4258a)
    #1 0x100b3e22d in dav1d_open lib.c:214
    #2 0x100834618 in LLVMFuzzerTestOneInput dav1d_fuzzer.c:131
    #3 0x1008357c1 in main main.c:94
    #4 0x7fff20626f3c in start+0x0 (libdyld.dylib:x86_64+0x15f3c)

Thread T1 created by T0 here:
    #0 0x100cc958a in wrap_pthread_create+0x5a (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4258a)
    #1 0x100b3e22d in dav1d_open lib.c:214
    #2 0x100834618 in LLVMFuzzerTestOneInput dav1d_fuzzer.c:131
    #3 0x1008357c1 in main main.c:94
    #4 0x7fff20626f3c in start+0x0 (libdyld.dylib:x86_64+0x15f3c)
Edited by Victorien Le Couviour--Tuffet

Merge request reports