id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc
812	Use-after-free in DecLib::xDecodeAPS(InputNALUnit&)	pierrick.bouvier		"In function DecLib::xDecodeAPS(InputNALUnit&), when storing an APS in parameterSetManager, pointer can be freed if APS has not changed.

In ParameterSetMap<APS>::storePS(int, APS*,...), we can observe that 


{{{
      // work out changed flag
      calculateParameterSetChangedFlag(mapData.bChanged, mapData.pNaluData, pNaluData);

      if( ! mapData.bChanged )
      {
        // just keep the old one
        delete ps;
        return;
      }

}}}

This results in aps being deleted, which is fine.

Alas, just after storing it, we check its type:

{{{
void DecLib::xDecodeAPS(InputNALUnit& nalu)
{
  APS* aps = new APS();
  ...
  m_parameterSetManager.storeAPS(aps, nalu.getBitstream().getFifo());
#if JVET_P0257_SCALING_LISTS_SPEEDUP_DEC
  if (aps->getAPSType() == SCALING_LIST_APS)
  {
    setScalingListUpdateFlag(true); // USE-AFTER-FREE
  }
  
#endif
}}}

Fix is simply to store it after checking its type.

This bug was found by Clang Memory Sanitizer.

Merge request: https://vcgit.hhi.fraunhofer.de/jvet/VVCSoftware_VTM/merge_requests/1223
"	defect	closed	minor	VTM-8.0	VTM	VTM-7.3	fixed		ksuehring XiangLi fbossen jvet@…