[FFmpeg-trac] #4148(avcodec:open): Crash in ff_add_bytes_l2_sse2 when decoding attached APNG file

[FFmpeg]

#4148: Crash in ff_add_bytes_l2_sse2 when decoding attached APNG file
-------------------------------------+-------------------------------------
             Reporter:  benoit       |                    Owner:
                 Type:  defect       |                   Status:  open
             Priority:  important    |                Component:  avcodec
              Version:  git-master   |               Resolution:
             Keywords:  png crash    |               Blocked By:
  SIGSEGV regression                 |  Reproduced by developer:  1
             Blocking:               |
Analyzed by developer:  0            |
-------------------------------------+-------------------------------------

Comment (by benoit):

 Well, there is already the scalar loop in the DSP. What would you think of
 just adding a test (on dst or src2, as they have the same alignment), like
 this (note that I don't speak yasm ;-):
 {{{
 diff --git a/libavcodec/x86/pngdsp.asm b/libavcodec/x86/pngdsp.asm
 index 8e23ccf..b43fb18 100644
 --- a/libavcodec/x86/pngdsp.asm
 +++ b/libavcodec/x86/pngdsp.asm
 @@ -36,9 +36,16 @@ cglobal add_bytes_l2, 4, 6, %1, dst, src1, src2, wa, w,
 i
      movsxd             waq, wad
  %endif
      xor                 iq, iq
 +    mov                 wq, waq
 +
 +    ; if dst buffer is unaligned, use scalar loop
 +    mov                 waq, dstq
 +    and                 waq, 15
 +    test                waq, waq
 +    jnz .end_s

      ; vector loop
 -    mov                 wq, waq
 +    mov                waq, wq
      and                waq, ~(mmsize*2-1)
      jmp .end_v
  .loop_v:
 }}}

--
Ticket URL: <https://trac.ffmpeg.org/ticket/4148#comment:5>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker