search

cisco / thor

Thor Video Codec
BSD 2-Clause "Simplified" License
697 stars 101 forks source link

NULL Pointer Dereference in interpolate_frame #40

Open 0xdd96 opened 2 years ago

0xdd96 commented 2 years ago

version: master (commit https://github.com/cisco/thor/commit/18de8f9f0762c3a542b1122589edb8af859d9813) poc: poc command: ./Thordec poc out.yuv

user@c3ae4d510abb:$ ./Thordec poc out.yuv
decode_frame_num=   0 display_frame_num=51657 input_file_size=          46 bitcnt=           0
Segmentation fault (core dumped)

Here is the backtrace in GDB:

pwndbg> backtrace
#0  0x00005555555a602f in interpolate_frame (k=<optimized out>, ratio=<optimized out>, h=34, w=256, outdata=0x0, indata1=0x7fffffff01c0, indata0=0x7fffffff01c0, mv_data=0x5555557a7f90) at common/temporal_interp.c:896
#1  interpolate_frames_hbd (new_frame=0x0, ref0=<optimized out>, ref1=<optimized out>, ratio=<optimized out>, pos=<optimized out>) at common/temporal_interp.c:967
#2  0x000055555555e0f7 in decode_frame (decoder_info=0x7fffffff7070, rec_buffer=0x7ffffffef5c0) at dec/decode_frame.c:110
#3  0x00005555555556b4 in main (argc=argc@entry=3, argv=argv@entry=0x7fffffffe468) at dec/maindec.c:179
#4  0x00007ffff7ca10b3 in __libc_start_main (main=0x5555555552c0 <main>, argc=3, argv=0x7fffffffe468, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe458) at ../csu/libc-start.c:308
#5  0x000055555555714e in _start () at /usr/include/x86_64-linux-gnu/bits/stdio2.h:100