From 6e47e941b657018064f6421cade12f81a2097a1e Mon Sep 17 00:00:00 2001 From: Wan-Teh Chang Date: Mon, 27 Jul 2026 14:59:51 -0700 Subject: [PATCH] Check the requirement on is_first_tile_group (#5143) Check the requirement of bitstream conformance that SeenFrameHeader is not equal to is_first_tile_group. If this requirement is not met, the decoder may skip the read_uncompressed_header() call in av2_read_tilegroup_header(), which eventually leads to a null pointer dereference. Fixes https://github.com/AOMediaCodec/avm/issues/5142. (cherry picked from commit 63be7278689dcff55a60fa94e02feb4a67daaa8b) --- av2/decoder/decodeframe.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/av2/decoder/decodeframe.c b/av2/decoder/decodeframe.c index 3fb800a37b..4aa97028fe 100644 --- a/av2/decoder/decodeframe.c +++ b/av2/decoder/decodeframe.c @@ -9610,6 +9610,14 @@ int32_t av2_read_tilegroup_header( send_first_tile_group_indication &= obu_type != OBU_BRIDGE_FRAME; if (send_first_tile_group_indication) is_first_tile_group = avm_rb_read_bit(rb); + // It is a requirement of bitstream conformance that SeenFrameHeader is not + // equal to is_first_tile_group. + if (pbi->seen_frame_header == is_first_tile_group) { + avm_internal_error( + &cm->error, AVM_CODEC_CORRUPT_FRAME, + "SeenFrameHeader (%d) is equal to is_first_tile_group (%d)", + pbi->seen_frame_header, is_first_tile_group); + } *first_tile_group_in_frame = is_first_tile_group; if (is_first_tile_group) {