Autodesk: Upgrade aom to v3.10.0

[erikaharrison-adsk]

Description of Change(s)

Upgrade aom version to v3.10.0

Fixes Issue(s)

• N/A

• I have verified that all unit tests pass with the proposed changes

• I have submitted a signed Contributor License Agreement

[meshula]

Hi! Thank you for taking on an upgrade of the aom library.

I was wondering if you might be able to say a few words about the motivation for upgrading? I can see that this version introduces a new concurrency system, a variety of optimizations for Neon, and a lot of general house keeping and code style improvements (such as replacing some macros with keywords).

Of course it is nice to be up to date, but I was wondering if you had encountered something that prompted an upgrade? Something like compatibility, performance, a new feature, or bringing the library into alignment with an internal version? Or is this a general maintenance contribution?

Thanks!

[zhangha182]

Hi! Thank you for taking on an upgrade of the aom library.

I was wondering if you might be able to say a few words about the motivation for upgrading? I can see that this version introduces a new concurrency system, a variety of optimizations for Neon, and a lot of general house keeping and code style improvements (such as replacing some macros with keywords).

Of course it is nice to be up to date, but I was wondering if you had encountered something that prompted an upgrade? Something like compatibility, performance, a new feature, or bringing the library into alignment with an internal version? Or is this a general maintenance contribution?

Thanks!

As the scan tool (BlackDuck) shows, libaom - v3.0.0 has a High vulnerability of BDSA-2024-3423 (CVE-2024-5171).

Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:

• Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.

• Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.

• Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.

[meshula]

Oh, that's very good to know. Thank you for taking action on it.

[jesschimein]

Filed as internal issue #USD-10143

[jesschimein]

/AzurePipelines run

[azure-pipelines]

Pull request contains merge conflicts.

[erikaharrison-adsk]

Branch updated to address merge conflicts.