Skip to content

decoder: guard threaded DPB reallocation - #3972

Open
BenzhengZhang wants to merge 4 commits into
cisco:masterfrom
BenzhengZhang:security/SPARK-801586-threaded-dpb-realloc
Open

decoder: guard threaded DPB reallocation#3972
BenzhengZhang wants to merge 4 commits into
cisco:masterfrom
BenzhengZhang:security/SPARK-801586-threaded-dpb-realloc

Conversation

@BenzhengZhang

Copy link
Copy Markdown
Collaborator

No description provided.

benzzhan added 4 commits July 29, 2026 10:41
Merge the two consecutive bNewSeqBegin blocks and drop the redundant pLastThreadCtx reset in ThreadDecodeFrameInternal; the barrier path already clears it before the DPB is reused. No behavior change.
…counting

In threaded decoding the shared DPB may be reallocated by any worker thread's context on a new sequence, but is freed via the primary context at teardown, leaving per-context MEMORY_MONITOR accounting imbalanced (asserts in debug/meson builds; no real leak). Record the allocating CMemoryAlign in SPicBuff and free through it.
Alternating IDR frames at two resolutions through the multi-threaded decoder reproduce the DPB reallocation use-after-free (SPARK-801586) before the guard fix.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant