mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2026-02-07 10:19:54 +00:00
c48b8ebbbb
The DPX Vulkan unpack shader computes a word offset as
uint off = (line_off + pix_off >> 5);
Due to GLSL operator precedence this is evaluated as
line_off + (pix_off >> 5) rather than (line_off + pix_off) >> 5.
Since line_off is in bits while off is a 32-bit word index,
scanlines beyond y=0 use an inflated offset and the shader reads
past the end of the DPX slice buffer.
Parenthesize the expression so that the sum is shifted as intended:
uint off = (line_off + pix_off) >> 5;
This corrects the unpacked data and removes the CRC mismatch
observed between the software and Vulkan DPX decoders for
mispacked 12-bit DPX samples. The GPU OOB read itself is only
observable indirectly via this corruption since it occurs inside
the shader.
Repro on x86_64 with Vulkan/llvmpipe (
|
||
|---|---|---|
| .. | ||
| common.comp | ||
| dpx_copy.comp | ||
| dpx_unpack.comp | ||
| ffv1_common.comp | ||
| ffv1_dec.comp | ||
| ffv1_dec_setup.comp | ||
| ffv1_enc.comp | ||
| ffv1_enc_rct.comp | ||
| ffv1_enc_setup.comp | ||
| ffv1_rct.comp | ||
| ffv1_rct_search.comp | ||
| ffv1_reset.comp | ||
| ffv1_vlc.comp | ||
| Makefile | ||
| prores_idct.comp | ||
| prores_raw_decode.comp | ||
| prores_raw_idct.comp | ||
| prores_vld.comp | ||
| rangecoder.comp | ||