[FFmpeg-cvslog] avcodec/dxva2_*: Initialize dxva_data_ptr

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sun May 26 22:41:23 2024 +0200| [189bc840b0ffc4e88ea70356b36213ce88b248ae] | committer: Michael Niedermayer

avcodec/dxva2_*: Initialize dxva_data_ptr

Related: CID1591888 Uninitialized scalar variable
Related: CID1591925 Uninitialized pointer read
Related: CID1591933 Uninitialized scalar variable

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=189bc840b0ffc4e88ea70356b36213ce88b248ae
---

 libavcodec/dxva2_av1.c   | 4 ++--
 libavcodec/dxva2_hevc.c  | 5 ++++-
 libavcodec/dxva2_mpeg2.c | 5 ++++-
 libavcodec/dxva2_vc1.c   | 5 ++++-
 libavcodec/dxva2_vp9.c   | 4 ++--
 5 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/libavcodec/dxva2_av1.c b/libavcodec/dxva2_av1.c
index 1b55510659..ea97fcb87e 100644
--- a/libavcodec/dxva2_av1.c
+++ b/libavcodec/dxva2_av1.c
@@ -354,7 +354,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     const AV1DecContext *h = avctx->priv_data;
     AVDXVAContext *ctx = DXVA_CONTEXT(avctx);
     struct av1_dxva2_picture_context *ctx_pic = h->cur_frame.hwaccel_picture_private;
-    void     *dxva_data_ptr;
+    void     *dxva_data_ptr = NULL;
     uint8_t  *dxva_data;
     unsigned dxva_size;
     unsigned padding;
@@ -382,7 +382,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
 
     dxva_data = dxva_data_ptr;
 
-    if (ctx_pic->bitstream_size > dxva_size) {
+    if (!dxva_data || ctx_pic->bitstream_size > dxva_size) {
         av_log(avctx, AV_LOG_ERROR, "Bitstream size exceeds hardware buffer");
         return -1;
     }
diff --git a/libavcodec/dxva2_hevc.c b/libavcodec/dxva2_hevc.c
index bd2c6f72a4..97e51d15de 100644
--- a/libavcodec/dxva2_hevc.c
+++ b/libavcodec/dxva2_hevc.c
@@ -248,7 +248,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     const HEVCFrame *current_picture = h->cur_frame;
     struct hevc_dxva2_picture_context *ctx_pic = current_picture->hwaccel_picture_private;
     DXVA_Slice_HEVC_Short *slice = NULL;
-    void     *dxva_data_ptr;
+    void     *dxva_data_ptr = NULL;
     uint8_t  *dxva_data, *current, *end;
     unsigned dxva_size;
     void     *slice_data;
@@ -278,6 +278,9 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     }
 #endif
 
+    if (!dxva_data_ptr)
+        return -1;
+
     dxva_data = dxva_data_ptr;
     current = dxva_data;
     end = dxva_data + dxva_size;
diff --git a/libavcodec/dxva2_mpeg2.c b/libavcodec/dxva2_mpeg2.c
index 4b58466878..d88e782414 100644
--- a/libavcodec/dxva2_mpeg2.c
+++ b/libavcodec/dxva2_mpeg2.c
@@ -160,7 +160,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
         s->cur_pic.ptr->hwaccel_picture_private;
     const int is_field = s->picture_structure != PICT_FRAME;
     const unsigned mb_count = s->mb_width * (s->mb_height >> is_field);
-    void     *dxva_data_ptr;
+    void     *dxva_data_ptr = NULL;
     uint8_t  *dxva_data, *current, *end;
     unsigned dxva_size;
     unsigned i;
@@ -186,6 +186,9 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     }
 #endif
 
+    if (!dxva_data_ptr)
+        return -1;
+
     dxva_data = dxva_data_ptr;
     current = dxva_data;
     end = dxva_data + dxva_size;
diff --git a/libavcodec/dxva2_vc1.c b/libavcodec/dxva2_vc1.c
index 6dc9cd8b5a..bc9ad9648e 100644
--- a/libavcodec/dxva2_vc1.c
+++ b/libavcodec/dxva2_vc1.c
@@ -197,7 +197,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     const unsigned start_code_size = avctx->codec_id == AV_CODEC_ID_VC1 ? sizeof(start_code) : 0;
     const unsigned mb_count = s->mb_width * (s->mb_height >> v->field_mode);
     DXVA_SliceInfo *slice = NULL;
-    void     *dxva_data_ptr;
+    void     *dxva_data_ptr = NULL;
     uint8_t  *dxva_data, *current, *end;
     unsigned dxva_size;
     unsigned padding;
@@ -224,6 +224,9 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     }
 #endif
 
+    if (!dxva_data_ptr)
+        return -1;
+
     dxva_data = dxva_data_ptr;
     current = dxva_data;
     end = dxva_data + dxva_size;
diff --git a/libavcodec/dxva2_vp9.c b/libavcodec/dxva2_vp9.c
index ca8b3b136d..f4ab91c580 100644
--- a/libavcodec/dxva2_vp9.c
+++ b/libavcodec/dxva2_vp9.c
@@ -172,7 +172,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
     const VP9SharedContext *h = avctx->priv_data;
     AVDXVAContext *ctx = DXVA_CONTEXT(avctx);
     struct vp9_dxva2_picture_context *ctx_pic = h->frames[CUR_FRAME].hwaccel_picture_private;
-    void     *dxva_data_ptr;
+    void     *dxva_data_ptr = NULL;
     uint8_t  *dxva_data;
     unsigned dxva_size;
     unsigned padding;
@@ -200,7 +200,7 @@ static int commit_bitstream_and_slice_buffer(AVCodecContext *avctx,
 
     dxva_data = dxva_data_ptr;
 
-    if (ctx_pic->slice.SliceBytesInBuffer > dxva_size) {
+    if (!dxva_data || ctx_pic->slice.SliceBytesInBuffer > dxva_size) {
         av_log(avctx, AV_LOG_ERROR, "Failed to build bitstream");
         return -1;
     }