From 5e680f30801d03c21078f8c4b772464752516211 Mon Sep 17 00:00:00 2001
From: Marco Paniconi <marpan@google.com>
Date: Mon, 14 Sep 2026 21:35:29 +0000
Subject: [PATCH] vp8: propagate worker thread errors in vp8mt_decode_mb_rows

If a worker thread encounters a bitstream error
(e.g. truncated/corrupt partition), it longjmps to
thread_decoding_proc() and records the error code in
mbd->error_info. However, this error was never checked or
propagated back to the main thread in vp8mt_decode_mb_rows().

As a result, the multi-threaded decoder treated the corrupted
frame as successfully decoded and returned a partially written
frame containing uninitialized or stale memory.

Fix is to reset mbd->error_info.error_code per frame in
setup_decoding_thread_data(), and check each worker thread's
error_info after worker threads finish decoding. If any worker
encountered an error, propagate it back to the caller and fail
the frame.

Unittest added.

Bug: 559707641
Change-Id: I8f50fbc35f0ce6e59718a5e7445b20969133299f
---
diff --git a/vp8/decoder/threading.c b/vp8/decoder/threading.c
index 99cf5a8..43d5649 100644
--- a/vp8/decoder/threading.c
+++ b/vp8/decoder/threading.c
@@ -55,6 +55,7 @@
     if (pc->frame_type == KEY_FRAME || pbi->ec_active) {
       mbd->corrupted = 0;
     }
+    mbd->error_info.error_code = 0;
 
     mbd->subpixel_predict = xd->subpixel_predict;
     mbd->subpixel_predict8x4 = xd->subpixel_predict8x4;
@@ -915,5 +916,12 @@
   for (i = 0; i < pbi->decoding_thread_count + 1; ++i)
     vp8_sem_wait(&pbi->h_event_end_decoding); /* add back for each frame */
 
+  for (i = 0; i < pbi->decoding_thread_count; ++i) {
+    if (pbi->mb_row_di[i].mbd.error_info.error_code) {
+      xd->error_info = pbi->mb_row_di[i].mbd.error_info;
+      return -1;
+    }
+  }
+
   return 0;
 }
diff --git a/test/decode_api_test.cc b/test/decode_api_test.cc
index 477f3b8..b95d519 100644
--- a/test/decode_api_test.cc
+++ b/test/decode_api_test.cc
@@ -242,6 +242,117 @@
   }
   EXPECT_EQ(vpx_codec_destroy(&dec), VPX_CODEC_OK);
 }
+
+// Issue: 559707641
+// Encodes a sequence of frames with two token partitions, truncates the second
+// token partition of one frame (used by a worker thread), and verifies that
+// the multi-threaded decoder returns VPX_CODEC_CORRUPT_FRAME and does not emit
+// a partially written frame. Also verifies that subsequent well-formed frames
+// still decode correctly.
+TEST(DecodeAPI, Vp8MultiThreadedWorkerDecodeErrorFailsFrame) {
+  constexpr int kWidth = 32;
+  constexpr int kHeight = 32;
+  class PatternVideoSource : public libvpx_test::DummyVideoSource {
+   protected:
+    void FillFrame() override {
+      if (!img_) return;
+      // Keep row 0 flat so partition 0 size is small.
+      memset(img_->planes[VPX_PLANE_Y], 128, img_->stride[VPX_PLANE_Y] * 16);
+      // Fill row 1 with varying pattern so partition 1 has tokens to truncate.
+      for (int y = 16; y < 32; ++y) {
+        uint8_t *row =
+            img_->planes[VPX_PLANE_Y] + y * img_->stride[VPX_PLANE_Y];
+        for (int x = 0; x < 32; ++x) {
+          row[x] = static_cast<uint8_t>((x * 37 + y * 73) ^ (frame_ * 19));
+        }
+      }
+      memset(img_->planes[VPX_PLANE_U], 128, img_->stride[VPX_PLANE_U] * 16);
+      memset(img_->planes[VPX_PLANE_V], 128, img_->stride[VPX_PLANE_V] * 16);
+    }
+  };
+
+  constexpr int kFrames = 4;
+  std::vector<std::vector<uint8_t>> frames;
+  {
+    vpx_codec_ctx_t enc;
+    vpx_codec_enc_cfg_t cfg;
+    ASSERT_EQ(vpx_codec_enc_config_default(&vpx_codec_vp8_cx_algo, &cfg, 0),
+              VPX_CODEC_OK);
+    cfg.g_w = kWidth;
+    cfg.g_h = kHeight;
+    cfg.g_lag_in_frames = 0;
+    ASSERT_EQ(vpx_codec_enc_init(&enc, &vpx_codec_vp8_cx_algo, &cfg, 0),
+              VPX_CODEC_OK);
+    ASSERT_EQ(vpx_codec_control(&enc, VP8E_SET_TOKEN_PARTITIONS,
+                                VP8_TWO_TOKENPARTITION),
+              VPX_CODEC_OK);
+
+    PatternVideoSource video;
+    video.SetSize(kWidth, kHeight);
+    video.set_limit(kFrames);
+    for (video.Begin(); video.img() != nullptr; video.Next()) {
+      ASSERT_EQ(
+          vpx_codec_encode(&enc, video.img(), video.pts(), video.duration(),
+                           VPX_EFLAG_FORCE_KF, VPX_DL_REALTIME),
+          VPX_CODEC_OK);
+      vpx_codec_iter_t iter = nullptr;
+      const vpx_codec_cx_pkt_t *pkt;
+      while ((pkt = vpx_codec_get_cx_data(&enc, &iter)) != nullptr) {
+        if (pkt->kind != VPX_CODEC_CX_FRAME_PKT) continue;
+        ASSERT_NE(pkt->data.frame.flags & VPX_FRAME_IS_KEY, 0u);
+        const uint8_t *buf = static_cast<const uint8_t *>(pkt->data.frame.buf);
+        frames.emplace_back(buf, buf + pkt->data.frame.sz);
+      }
+    }
+    ASSERT_EQ(vpx_codec_destroy(&enc), VPX_CODEC_OK);
+  }
+  ASSERT_EQ(frames.size(), static_cast<size_t>(kFrames));
+
+  // Truncate frame 1 so that only a single byte of the second token partition
+  // remains. The first token partition (used by the main thread) is left
+  // intact.
+  {
+    std::vector<uint8_t> &f = frames[1];
+    ASSERT_GT(f.size(), 10u);
+    const size_t first_part_sz =
+        (static_cast<size_t>(f[0]) | (static_cast<size_t>(f[1]) << 8) |
+         (static_cast<size_t>(f[2]) << 16)) >>
+        5;
+    const size_t part_sizes = 10 + first_part_sz;
+    ASSERT_LT(part_sizes + 3, f.size());
+    const size_t part0_sz = static_cast<size_t>(f[part_sizes]) |
+                            (static_cast<size_t>(f[part_sizes + 1]) << 8) |
+                            (static_cast<size_t>(f[part_sizes + 2]) << 16);
+    const size_t part1_start = part_sizes + 3 + part0_sz;
+    ASSERT_LT(part1_start, f.size());
+    f.resize(part1_start + 1);
+  }
+
+  vpx_codec_ctx_t dec;
+  vpx_codec_dec_cfg_t dec_cfg = { /*threads=*/4, /*w=*/0, /*h=*/0 };
+  ASSERT_EQ(vpx_codec_dec_init(&dec, &vpx_codec_vp8_dx_algo, &dec_cfg, 0),
+            VPX_CODEC_OK);
+  for (int i = 0; i < kFrames; ++i) {
+    const vpx_codec_err_t res = vpx_codec_decode(
+        &dec, frames[i].data(), static_cast<unsigned int>(frames[i].size()),
+        /*user_priv=*/nullptr, /*deadline=*/0);
+    vpx_codec_iter_t iter = nullptr;
+    const vpx_image_t *img = vpx_codec_get_frame(&dec, &iter);
+    if (i == 1) {
+      EXPECT_EQ(res, VPX_CODEC_CORRUPT_FRAME);
+      EXPECT_EQ(img, nullptr);
+      continue;
+    }
+    EXPECT_EQ(res, VPX_CODEC_OK)
+        << "frame " << i << ": " << vpx_codec_error_detail(&dec);
+    EXPECT_NE(img, nullptr) << "frame " << i;
+    int corrupted = -1;
+    EXPECT_EQ(vpx_codec_control(&dec, VP8D_GET_FRAME_CORRUPTED, &corrupted),
+              VPX_CODEC_OK);
+    EXPECT_EQ(corrupted, 0) << "frame " << i;
+  }
+  EXPECT_EQ(vpx_codec_destroy(&dec), VPX_CODEC_OK);
+}
 #endif  // CONFIG_VP8_ENCODER && CONFIG_MULTITHREAD
 #endif  // CONFIG_VP8_DECODER
 

diff --git a/test/decode_api_test.cc b/test/decode_api_test.cc
index 477f3b8..b95d519 100644
--- a/test/decode_api_test.cc
+++ b/test/decode_api_test.cc
@@ -242,6 +242,117 @@
   }
   EXPECT_EQ(vpx_codec_destroy(&dec), VPX_CODEC_OK);
 }
+
+// Issue: 559707641
+// Encodes a sequence of frames with two token partitions, truncates the second
+// token partition of one frame (used by a worker thread), and verifies that
+// the multi-threaded decoder returns VPX_CODEC_CORRUPT_FRAME and does not emit
+// a partially written frame. Also verifies that subsequent well-formed frames
+// still decode correctly.
+TEST(DecodeAPI, Vp8MultiThreadedWorkerDecodeErrorFailsFrame) {
+  constexpr int kWidth = 32;
+  constexpr int kHeight = 32;
+  class PatternVideoSource : public libvpx_test::DummyVideoSource {
+   protected:
+    void FillFrame() override {
+      if (!img_) return;
+      // Keep row 0 flat so partition 0 size is small.
+      memset(img_->planes[VPX_PLANE_Y], 128, img_->stride[VPX_PLANE_Y] * 16);
+      // Fill row 1 with varying pattern so partition 1 has tokens to truncate.
+      for (int y = 16; y < 32; ++y) {
+        uint8_t *row =
+            img_->planes[VPX_PLANE_Y] + y * img_->stride[VPX_PLANE_Y];
+        for (int x = 0; x < 32; ++x) {
+          row[x] = static_cast<uint8_t>((x * 37 + y * 73) ^ (frame_ * 19));
+        }
+      }
+      memset(img_->planes[VPX_PLANE_U], 128, img_->stride[VPX_PLANE_U] * 16);
+      memset(img_->planes[VPX_PLANE_V], 128, img_->stride[VPX_PLANE_V] * 16);
+    }
+  };
+
+  constexpr int kFrames = 4;
+  std::vector<std::vector<uint8_t>> frames;
+  {
+    vpx_codec_ctx_t enc;
+    vpx_codec_enc_cfg_t cfg;
+    ASSERT_EQ(vpx_codec_enc_config_default(&vpx_codec_vp8_cx_algo, &cfg, 0),
+              VPX_CODEC_OK);
+    cfg.g_w = kWidth;
+    cfg.g_h = kHeight;
+    cfg.g_lag_in_frames = 0;
+    ASSERT_EQ(vpx_codec_enc_init(&enc, &vpx_codec_vp8_cx_algo, &cfg, 0),
+              VPX_CODEC_OK);
+    ASSERT_EQ(vpx_codec_control(&enc, VP8E_SET_TOKEN_PARTITIONS,
+                                VP8_TWO_TOKENPARTITION),
+              VPX_CODEC_OK);
+
+    PatternVideoSource video;
+    video.SetSize(kWidth, kHeight);
+    video.set_limit(kFrames);
+    for (video.Begin(); video.img() != nullptr; video.Next()) {
+      ASSERT_EQ(
+          vpx_codec_encode(&enc, video.img(), video.pts(), video.duration(),
+                           VPX_EFLAG_FORCE_KF, VPX_DL_REALTIME),
+          VPX_CODEC_OK);
+      vpx_codec_iter_t iter = nullptr;
+      const vpx_codec_cx_pkt_t *pkt;
+      while ((pkt = vpx_codec_get_cx_data(&enc, &iter)) != nullptr) {
+        if (pkt->kind != VPX_CODEC_CX_FRAME_PKT) continue;
+        ASSERT_NE(pkt->data.frame.flags & VPX_FRAME_IS_KEY, 0u);
+        const uint8_t *buf = static_cast<const uint8_t *>(pkt->data.frame.buf);
+        frames.emplace_back(buf, buf + pkt->data.frame.sz);
+      }
+    }
+    ASSERT_EQ(vpx_codec_destroy(&enc), VPX_CODEC_OK);
+  }
+  ASSERT_EQ(frames.size(), static_cast<size_t>(kFrames));
+
+  // Truncate frame 1 so that only a single byte of the second token partition
+  // remains. The first token partition (used by the main thread) is left
+  // intact.
+  {
+    std::vector<uint8_t> &f = frames[1];
+    ASSERT_GT(f.size(), 10u);
+    const size_t first_part_sz =
+        (static_cast<size_t>(f[0]) | (static_cast<size_t>(f[1]) << 8) |
+         (static_cast<size_t>(f[2]) << 16)) >>
+        5;
+    const size_t part_sizes = 10 + first_part_sz;
+    ASSERT_LT(part_sizes + 3, f.size());
+    const size_t part0_sz = static_cast<size_t>(f[part_sizes]) |
+                            (static_cast<size_t>(f[part_sizes + 1]) << 8) |
+                            (static_cast<size_t>(f[part_sizes + 2]) << 16);
+    const size_t part1_start = part_sizes + 3 + part0_sz;
+    ASSERT_LT(part1_start, f.size());
+    f.resize(part1_start + 1);
+  }
+
+  vpx_codec_ctx_t dec;
+  vpx_codec_dec_cfg_t dec_cfg = { /*threads=*/4, /*w=*/0, /*h=*/0 };
+  ASSERT_EQ(vpx_codec_dec_init(&dec, &vpx_codec_vp8_dx_algo, &dec_cfg, 0),
+            VPX_CODEC_OK);
+  for (int i = 0; i < kFrames; ++i) {
+    const vpx_codec_err_t res = vpx_codec_decode(
+        &dec, frames[i].data(), static_cast<unsigned int>(frames[i].size()),
+        /*user_priv=*/nullptr, /*deadline=*/0);
+    vpx_codec_iter_t iter = nullptr;
+    const vpx_image_t *img = vpx_codec_get_frame(&dec, &iter);
+    if (i == 1) {
+      EXPECT_EQ(res, VPX_CODEC_CORRUPT_FRAME);
+      EXPECT_EQ(img, nullptr);
+      continue;
+    }
+    EXPECT_EQ(res, VPX_CODEC_OK)
+        << "frame " << i << ": " << vpx_codec_error_detail(&dec);
+    EXPECT_NE(img, nullptr) << "frame " << i;
+    int corrupted = -1;
+    EXPECT_EQ(vpx_codec_control(&dec, VP8D_GET_FRAME_CORRUPTED, &corrupted),
+              VPX_CODEC_OK);
+    EXPECT_EQ(corrupted, 0) << "frame " << i;
+  }
+  EXPECT_EQ(vpx_codec_destroy(&dec), VPX_CODEC_OK);
+}
 #endif  // CONFIG_VP8_ENCODER && CONFIG_MULTITHREAD
 #endif  // CONFIG_VP8_DECODER