Opened 4 years ago

Closed 4 years ago

#812 closed defect (fixed)

Use-after-free in DecLib::xDecodeAPS(InputNALUnit&)

Reported by: pierrick.bouvier Owned by:
Priority: minor Milestone: VTM-8.0
Component: VTM Version: VTM-7.3
Keywords: Cc: ksuehring, XiangLi, fbossen, jvet@…


In function DecLib::xDecodeAPS(InputNALUnit&), when storing an APS in parameterSetManager, pointer can be freed if APS has not changed.

In ParameterSetMap<APS>::storePS(int, APS*,...), we can observe that

      // work out changed flag
      calculateParameterSetChangedFlag(mapData.bChanged, mapData.pNaluData, pNaluData);

      if( ! mapData.bChanged )
        // just keep the old one
        delete ps;

This results in aps being deleted, which is fine.

Alas, just after storing it, we check its type:

void DecLib::xDecodeAPS(InputNALUnit& nalu)
  APS* aps = new APS();
  m_parameterSetManager.storeAPS(aps, nalu.getBitstream().getFifo());
  if (aps->getAPSType() == SCALING_LIST_APS)
    setScalingListUpdateFlag(true); // USE-AFTER-FREE

Fix is simply to store it after checking its type.

This bug was found by Clang Memory Sanitizer.

Merge request:

Change history (1)

comment:1 Changed 4 years ago by ksuehring

  • Milestone changed from VTM-7.2 to VTM-8.0
  • Resolution set to fixed
  • Status changed from new to closed
  • Version set to VTM-7.3

The MR was merged.

Note: See TracTickets for help on using tickets.