heap-use-after-free in od_ec_dec_refill() src/msac.c
Found with commit 6ac49461
Steps to reproduce:
- build dav1d with AddressSanitizer
- replay testcase with dav1d fuzzer
==14202==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e0000000f9 at pc 0x000000593531 bp 0x7ffe15609390 sp 0x7ffe15609388
READ of size 1 at 0x61e0000000f9 thread T0
#0 0x593530 in od_ec_dec_refill src/msac.c:128:26
#1 0x593530 in od_ec_dec_normalize src/msac.c:157
#2 0x571f62 in msac_decode_bool_adapt src/msac.h:48:26
#3 0x571f62 in read_mv_component_diff src/decode.c:85
#4 0x570014 in read_mv_residual src/decode.c:116:22
#5 0x560b30 in decode_b src/decode.c:1619:17
#6 0x532261 in decode_sb src/decode.c
#7 0x52fd37 in dav1d_decode_tile_sbrow src/decode.c:2319:13
#8 0x53d52d in dav1d_decode_frame src/decode.c:2662:29
#9 0x545ada in dav1d_submit_frame src/decode.c:3032:20
#10 0x51c48e in dav1d_parse_obus src/obu.c:1079:20
#11 0x517554 in dav1d_decode src/lib.c:193:20
#12 0x51297d in LLVMFuzzerTestOneInput tests/libfuzzer/dav1d_fuzzer.c:75:19
0x61e0000000f9 is located 121 bytes inside of 2483-byte region [0x61e000000080,0x61e000000a33)
freed by thread T0 here:
#0 0x4d9ea0 in __interceptor_free.localalias.0 (dav1d_fuzzer+0x4d9ea0)
#1 0x51574f in dav1d_ref_dec src/ref.c:78:9
#2 0x514f01 in dav1d_data_unref src/data.c:72:9
#3 0x517635 in dav1d_decode src/lib.c:199:22
#4 0x51297d in LLVMFuzzerTestOneInput tests/libfuzzer/dav1d_fuzzer.c:75:19
previously allocated by thread T0 here:
#0 0x4daca8 in __interceptor_posix_memalign (dav1d_fuzzer+0x4daca8)
#1 0x515133 in dav1d_alloc_aligned include/common/mem.h:46:9
#2 0x515133 in dav1d_ref_create src/ref.c:40
#3 0x5149cc in dav1d_data_create src/data.c:43:16
#4 0x5128c6 in LLVMFuzzerTestOneInput tests/libfuzzer/dav1d_fuzzer.c:68:15