Skip to content

oss-fuzz: Assertion 'seg_id < 8' failed in get_prev_frame_segid() src/decode.c:664

Reproduced with commit 46e2a2d0

Steps to reproduce:

  1. build dav1d with -Dbuildtype=debugoptimized
  2. replay testcase with ./dav1d_fuzzer clusterfuzz-testcase-minimized-dav1d_fuzzer-5740590025670656

clusterfuzz-testcase-minimized-dav1d_fuzzer-5740590025670656

dav1d_fuzzer: src/decode.c:664: unsigned int get_prev_frame_segid(const Dav1dFrameContext *const, const int, const int, const int, int, const uint8_t *, const ptrdiff_t): Assertion `seg_id < 8' failed.

==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f5f33c3d428 bp 0x0000006862c0 sp 0x7fff8e2c04c8 T0)
SCARINESS: 10 (signal)
    #0 0x7f5f33c3d427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54
    #1 0x7f5f33c3f029 in abort /build/glibc-Cl5G7W/glibc-2.23/stdlib/abort.c:89
    #2 0x7f5f33c35bd6 in __assert_fail_base /build/glibc-Cl5G7W/glibc-2.23/assert/assert.c:92
    #3 0x7f5f33c35c81 in __assert_fail /build/glibc-Cl5G7W/glibc-2.23/assert/assert.c:101
    #4 0x55f3c9 in get_prev_frame_segid src/decode.c:664:5
    #5 0x551f31 in decode_b src/decode.c:761:29
    #6 0x54610b in decode_sb src/decode.c:2080:17
    #7 0x544ebf in dav1d_decode_tile_sbrow src/decode.c:2323:13
    #8 0x54b691 in dav1d_decode_frame src/decode.c:2668:29
    #9 0x55088e in dav1d_submit_frame src/decode.c:3041:20
    #10 0x5384ef in dav1d_parse_obus src/obu.c:1110:20
    #11 0x5356a6 in dav1d_decode src/lib.c:201:20
    #12 0x53209b in LLVMFuzzerTestOneInput tests/libfuzzer/dav1d_fuzzer.c:82:19
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information