Skip to content

oss-fuzz: index out of bounds in decode_b() src/decode.c

Reproduced with commit 1e852dc1

Steps to reproduce:

  1. build dav1d with UndefinedBehaviorSanitizer (-fsanitize=undefined)
  2. replay testcase with ./dav1d_fuzzer_mt clusterfuzz-testcase-minimized-dav1d_fuzzer_mt-5750775674830848

clusterfuzz-testcase-minimized-dav1d_fuzzer_mt-5750775674830848

src/decode.c:738:43: runtime error: index 159 out of bounds for type 'const uint8_t [10][2]'
    #0 0x44d766 in decode_b src/decode.c:738:43
    #1 0x43a54f in decode_sb src/decode.c:1925:17
    #2 0x438d5d in dav1d_decode_tile_sbrow src/decode.c:2238:17
    #3 0x431d8e in dav1d_tile_task src/thread_task.c:89:29
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information