Skip to content

oss-fuzz: uninitilized frame data

This oss-fuzz test case has uninitilized frame data at poc=63,y=64,x=16. Discovered by

==1==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x59ad34 in iclip /src/dav1d/include/common/intops.h:44:28
    #1 0x5983c7 in resize_c /src/dav1d/src/mc_tmpl.c:794:22
    #2 0x6788a1 in backup_lpf /src/dav1d/src/lr_apply_tmpl.c:77:13
    #3 0x67786a in dav1d_lr_copy_lpf_8bpc /src/dav1d/src/lr_apply_tmpl.c:115:9
    #4 0x5d33a7 in dav1d_filter_sbrow_8bpc /src/dav1d/src/recon_tmpl.c:1583:9
    #5 0x4d494e in dav1d_decode_frame /src/dav1d/src/decode.c:2830:25
    #6 0x4dd4b8 in dav1d_submit_frame /src/dav1d/src/decode.c:3270:20
    #7 0x4ad743 in dav1d_parse_obus /src/dav1d/src/obu.c:1292:20
    #8 0x4a7994 in dav1d_get_picture /src/dav1d/src/lib.c:251:20
    #9 0x49ffa7 in LLVMFuzzerTestOneInput /src/dav1d/tests/libfuzzer/dav1d_fuzzer.c:117:19
    #10 0x6d552b in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
    #11 0x68d4d6 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6
    #12 0x69e2fa in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9
    #13 0x68c601 in main /src/libfuzzer/FuzzerMain.cpp:20:10
    #14 0x7f7fab49b82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
    #15 0x41e8e8 in _start

clusterfuzz-testcase-minimized-dav1d_fuzzer-5657755306688512

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information