Add range check min_gf_interval in validate_config - #5298
Merged
Conversation
Contributor
|
@xinzhao-apple : Good catch! However, I see that for max_gf_interval, we have a range check here itself: https://github.com/AOMediaCodec/avm/blob/main/av2/av2_cx_iface.c#L698 It seems best to do the same for min_gf_interval also. |
xinzhao-apple
force-pushed
the
mr/avm-bugfix2
branch
from
August 20, 2026 18:39
c419bc0 to
073f0c5
Compare
xinzhao-apple
changed the title
Contributor
Author
@urvangjoshi , I agree, the commit has been amended, please take a look. Thanks! |
urvangjoshi
approved these changes
Aug 20, 2026
--min-gf-interval=1..3 was accepted, bypassing the clamp to MIN_GF_INTERVAL (4) that the auto path applies. That defeats the baseline_gf_interval < min_gf_interval guard in define_gf_group() (pass2_strategy.c), and a degenerate end-of-sequence group then builds an ARF whose temporal filter reads past the end of the lookahead: av2_lookahead_peek() returns NULL behind an assert compiled out under NDEBUG, faulting in tf_setup_filtering_buffer(). Add a lower bound for min_gf_interval, mirroring the check already present for max_gf_interval. The max_gf_interval floor also has to move from 2 to MIN_GF_INTERVAL: with min unset it admitted --max-gf-interval=2, which the trailing AVMMIN(min, max) in av2_rc_set_gf_interval_range() then propagated into min_gf_interval, reaching the same crash by a second route. Values below MIN_GF_INTERVAL are now rejected with AVM_CODEC_INVALID_PARAM rather than silently clamped, so a caller is told its request was not honoured. Valid configurations are unaffected and bit-identical.
urvangjoshi
force-pushed
the
mr/avm-bugfix2
branch
from
August 20, 2026 22:04
073f0c5 to
8308c12
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
--min-gf-interval=1..3 bypasses the clamp the auto path applies, which defeats the baseline_gf_interval < min_gf_interval guard in define_gf_group(). A degenerate end-of-sequence group then builds an ARF whose temporal filter reads past the end of the lookahead and segfaults.
Valid configurations are bit-identical; 1..3 now match min=4.
This resolves issue #5297.