This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 495b402f27 avcodec/diracdec: fix heap buffer overflow in
edge_emu_buffer
495b402f27 is described below
commit 495b402f275e1540dbeb7cca7579d6c1a3a725fa
Author: Anthony Hurtado <[email protected]>
AuthorDate: Tue May 19 17:21:20 2026 -0500
Commit: michaelni <[email protected]>
CommitDate: Wed Jun 3 23:37:46 2026 +0000
avcodec/diracdec: fix heap buffer overflow in edge_emu_buffer
Fixes: poc_dirac_v2_*
---
libavcodec/diracdec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c
index 2a047c0bb9..a4a719aa8e 100644
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -339,7 +339,7 @@ static int alloc_buffers(DiracContext *s, int stride)
av_freep(&s->mctmp);
av_freep(&s->mcscratch);
- s->edge_emu_buffer_base = av_malloc_array(stride, MAX_BLOCKSIZE);
+ s->edge_emu_buffer_base = av_malloc_array(stride, 4 * MAX_BLOCKSIZE);
s->mctmp = av_malloc_array((stride+MAX_BLOCKSIZE), (h +
5*MAX_BLOCKSIZE) * sizeof(*s->mctmp));
s->mcscratch = av_malloc_array(stride, MAX_BLOCKSIZE);
@@ -1895,7 +1895,7 @@ static int dirac_decode_frame_internal(DiracContext *s)
/* FIXME: small resolutions */
for (i = 0; i < 4; i++)
- s->edge_emu_buffer[i] = s->edge_emu_buffer_base +
i*FFALIGN(p->width, 16);
+ s->edge_emu_buffer[i] = s->edge_emu_buffer_base +
i*s->buffer_stride*MAX_BLOCKSIZE;
if (!s->zero_res && !s->low_delay)
{
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
