File dav1d-CVE-2023-32570.patch of Package dav1d

Overview Repositories Revisions Requests Users Attributes Meta

File dav1d-CVE-2023-32570.patch of Package dav1d

From cf617fdae0b9bfabd27282854c8e81450d955efa Mon Sep 17 00:00:00 2001
From: Victorien Le Couviour--Tuffet <victorien@videolan.org>
Date: Mon, 13 Mar 2023 13:46:43 +0100
Subject: [PATCH] threading: Ensure passing the correct retval to
 decode_frame_exit

We must reload error just before calling dav1d_decode_frame_exit, as
it may have become stale between the last load and that call.
This can result in crashes since we signal a seemingly successfully decoded
frame, when it's not.
Reloading error within the frame done condition's body ensures a non-stale
value, as we use 'f->task_thread.task_counter == 0' to ensure all other
threads / tasks have already completed when entering it. In other words, only
the last thread still working on this frame can execute this code, after
all other threads have returned to doing something else.
---
 src/thread_task.c | 3 +++
 1 file changed, 3 insertions(+)

diff -urp dav1d-1.0.0.orig/src/thread_task.c dav1d-1.0.0/src/thread_task.c
--- dav1d-1.0.0.orig/src/thread_task.c	2022-03-18 08:31:21.000000000 -0500
+++ dav1d-1.0.0/src/thread_task.c	2023-05-10 11:20:55.581769465 -0500
@@ -695,6 +695,7 @@ void *dav1d_worker_task(void *data) {
                 if (!--f->task_thread.task_counter && f->task_thread.done[0] &&
                     (!uses_2pass || f->task_thread.done[1]))
                 {
+                    error = atomic_load(&f->task_thread.error);
                     dav1d_decode_frame_exit(f, error == 1 ? DAV1D_ERR(EINVAL) :
                                             error ? DAV1D_ERR(ENOMEM) : 0);
                     f->n_tile_data = 0;
@@ -811,6 +812,7 @@ void *dav1d_worker_task(void *data) {
         if (!--f->task_thread.task_counter &&
             f->task_thread.done[0] && (!uses_2pass || f->task_thread.done[1]))
         {
+            error = atomic_load(&f->task_thread.error);
             dav1d_decode_frame_exit(f, error == 1 ? DAV1D_ERR(EINVAL) :
                                     error ? DAV1D_ERR(ENOMEM) : 0);
             f->n_tile_data = 0;

Places

File dav1d-CVE-2023-32570.patch of Package dav1d

Places