droidvdec: fix segfault decoding NV12 semi-planar frames - #87
Open
Michal-Szczepaniak wants to merge 1 commit into
Open
droidvdec: fix segfault decoding NV12 semi-planar frames#87Michal-Szczepaniak wants to merge 1 commit into
Michal-Szczepaniak wants to merge 1 commit into
Conversation
This was referenced Aug 19, 2026
Michal-Szczepaniak
force-pushed
the
fix/decoder-stride-slice-height
branch
from
August 19, 2026 15:30
3bd2196 to
e490867
Compare
gst_droidvec_copy_packed_planes() and the semi-planar I420 conversion computed the source Y/UV plane pointers from hardcoded alignment guesses (stride aligned to 128, slice height aligned to 32/16) instead of the actual buffer layout, and never checked those pointers against the size of the buffer droidmedia handed over. When a decoder's real output geometry doesn't match the guess, this reads out of bounds and segfaults. Use the stride/slice_height now reported by droid_media_codec_get_output_info() when available, falling back to the previous alignment guess otherwise. When the codec doesn't report real geometry and the aligned guess doesn't fit the buffer droidmedia actually reports, fall back further to the unpadded exact-dimensions geometry if that fits instead, since some decoders emit tightly packed buffers with no slice padding at all. Bounds-check the computed frame size against DroidMediaData::size before touching the buffer so a bad guess or undersized buffer drops the frame with a GST_ELEMENT_ERROR instead of crashing. Requires the corresponding droidmedia change that adds stride/slice_height to DroidMediaCodecMetaData.
Michal-Szczepaniak
force-pushed
the
fix/decoder-stride-slice-height
branch
from
August 19, 2026 17:10
e490867 to
f06bd02
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
gst_droidvdec_convert_yuv420_semi_planar_to_i420() and gst_droidvdec_convert_yuv420_packed_semi_planar_to_i420() computed the source Y/UV plane pointers from hardcoded alignment guesses (stride aligned to 128, slice height aligned to 32/16) instead of the actual buffer layout, and never checked those pointers against the size of the buffer droidmedia handed over. When a decoder's real output geometry doesn't match the guess, this reads out of bounds and segfaults.
Use the stride/slice_height now reported by droid_media_codec_get_output_info() when available, falling back to the previous alignment guess otherwise, and bounds-check the computed frame size against DroidMediaData::size before touching the buffer so a bad guess or undersized buffer drops the frame with a GST_ELEMENT_ERROR instead of crashing.
Requires the corresponding droidmedia change that adds stride/slice_height to DroidMediaCodecMetaData.
Have in mind the fix has been written by LLM as has been above message. This fixes crash in gst-droid when using qmlglsink.
Corresponding droidmedia PR sailfishos/droidmedia#139