[COVERITY] Fix high impact findings#1#1#1
Open
prashanth-intel wants to merge 25 commits into
Open
Conversation
CIDs 6156251,6159321,6162447,6169107,6170270,6157033,6161854, 6165203,6171625,6172479: event/semaphore code checked shared state (event->state / sem->count) outside the mutex, allowing races where the pre-check can be invalidated before lock acquisition. Moved validity checks under mutex in vm_event_* and vm_semaphore_* paths, preserving behavior while closing the lock-evasion race windows. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
CIDs 6165706,6169258: CreateCmDevice leaked loaded shared-library handles on createFunc lookup failure and create function error paths; MFXDoWork used scheduler interface after Release, which can cause lifetime/cleanup misuse in error analysis paths. Added vm_so_free() in both failing CreateCmDevice branches and reordered MFXDoWork to call DoWork before Release. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
CID 6195611: PackPicHeader appends the current picture into ReferenceFrames[count] when pps_curr_pic_ref_enabled_flag is set, but it does not re-check capacity before writing count index. Added a count capacity guard before writing the current picture entry. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
CIDs 6195346,6188914,6185765: local mfxVideoParam temp in VC1 DecodeHeader was not initialized before ParseSeqHeader fills it; and H265 Seq/Pic parameter set Reset paths did not initialize m_changed. Value-initialized temp and explicitly set m_changed=false in both H265 reset routines. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
CIDs 6183001,6195148,6198464: several cleanup loops relied on unsigned index wraparound sentinels (setting index to -1) after erase/remove, which static analysis flags as overflow-prone index arithmetic. Rewrote those loops to explicit while/continue or safe index reset without unsigned wraparound behavior. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
CID 6190864: VP8DECODERoutine deleted '&data' where data was a reference bound to heap memory from p_state; deleting an address-of expression is unsafe and flagged as invalid free. Switched to pointer-based handling of p_state and deleted the original heap pointer directly. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
CID 6180696: JPEG dequant init used reinterpret casts between uint16_t* and int16_t* in zigzag and copy paths, which can trigger illegal address computation/aliasing warnings in static analysis. Replaced cast-based path with typed temporary int16_t buffers and a safe uint16_t copy-back, removing pointer reinterpret arithmetic. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
CID 6164413: ForEachTaskWhile forwarded the same callable object on every iteration via std::forward<F>(f), which can move-from f on first call and reuse a moved-from functor in subsequent iterations. Switched repeated invocation to direct f(task) and same change in ForEachTask wrapper lambda. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
CID 6195506: MVC_Extension::AllocateView declared ViewItem view without
value initialization before setting selected fields and copying it into
m_views.
Value-initialized ViewItem view = {} before allocation/population.
Tracked-On: NIACP3-1264
Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
…nding) CID 6177607: partial allocations in H265ScalingList::init leaked when h265_new_array_throw throws after earlier size buckets were allocated, because m_initialized stays false and destroy() is not called. Added try/catch cleanup that frees already allocated dequant tables and rethrows. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
CID 6194262: add_unique_fragments took a reference to stack.back(), then pop_back() and used the reference afterwards in fragments.push_back(cr), which dereferences an invalidated internal location. Copied stack.back() to a local value before pop_back and pushed that copy. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
CID 6172166: frame handle pointers were taken from temporary vectors allocated_mids/allocated_surfaces and then those vectors were moved into object state, leaving stored pointers potentially dangling. Moved vectors into object storage first and then built frame-handle pointers from self->m_allocatedMids/self->m_allocatedSurfaces. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
Pre-check exits in VPP init could leak an allocated entrypoint array on failure paths. Use RAII ownership for the VA entrypoint buffer so all returns release memory safely. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
…ndings) Computing abs on signed delta could overflow for the minimum negative value and taint RPS fields. Compute absolute delta via a wider signed type before narrowing to avoid signed overflow. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
Reference-list and temporal-layer index calculations could read past valid bounds in edge inputs. Clamp active reference counts and guard temporal-layer indexing before reading arrays. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
LTR marking logic could index the DPB array with a not-found position from frame-order lookup. Validate lookup result against active DPB size before dereferencing and treat misses as invalid. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
Early failure on plugin-param query could exit decode setup after resources were prepared on the path. Handle plugin-param query as optional and keep the decode path progressing unless the core flow fails. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
…findings) Composition paths stored stack-backed region pointers in persistent pipeline structs across calls. Clear transient pointer fields before return so stale wrapper references are not retained. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
RPS optimization logic could underflow nSet arithmetic and propagate unsafe integer computations. Added small-set guard and protected nSet-1 math so bit-estimation never evaluates invalid negative paths. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
Scheduler interface release relied on manual cleanup and could leak on early-return/control-flow changes. Wrapped queried scheduler pointer in unique_ptr with Release deleter for guaranteed reclamation. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
Fragment-level index use was not robust against invalid/advanced fragment levels in iterative splitting logic. Use size_t-based bounds and guarded indexing before dereferencing fragments vector entries. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
Composition loops allowed parameter/index mismatch causing out-of-range wrapper/vector access in VAAPI paths. Added layer-count validation and fixed off-by-one loop bound to keep indexing inside allocated vectors. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
HEVC SPS/PPS wrapper objects relied on Reset paths and could be observed before explicit scalar initialization. Initialized change-tracking scalar in constructors for deterministic object state on creation. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
JPEG quant-table init copied from caller buffer without explicit pointer validation in public entry path. Added null-input check before memory copy to avoid invalid address use on malformed call sites. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
Temporary ViewItem construction in AllocateView left scalar state dependent on default/reset sequencing. Added explicit scalar and array initialization before allocation path to guarantee deterministic ViewItem state. Tracked-On: NIACP3-1264 Signed-off-by: Anisetti Avinash Krishna <anisetti.avinash.krishna@intel.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix Coverity findings: Out-of-bounds access, resource leaks, and more
Tracked-On: NIACP3-1264