This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 7309ad9fd78d875e60427daa52260834e27ef2ea Author: Timo Rothenpieler <[email protected]> AuthorDate: Thu Jul 9 00:29:01 2026 +0200 Commit: Timo Rothenpieler <[email protected]> CommitDate: Mon Jul 13 21:13:25 2026 +0200 avcodec/d3d12va_av1: check slice bitstream size against available buffer size --- libavcodec/d3d12va_av1.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/libavcodec/d3d12va_av1.c b/libavcodec/d3d12va_av1.c index a3ddf0495a..bcf28ed590 100644 --- a/libavcodec/d3d12va_av1.c +++ b/libavcodec/d3d12va_av1.c @@ -33,6 +33,7 @@ typedef struct D3D12AV1DecodeContext { D3D12VADecodeContext ctx; uint8_t *bitstream_buffer; + size_t bitstream_size; } D3D12AV1DecodeContext; #define D3D12_AV1_DECODE_CONTEXT(avctx) ((D3D12AV1DecodeContext *)D3D12VA_DECODE_CONTEXT(avctx)) @@ -77,6 +78,7 @@ static int d3d12va_av1_decode_slice(AVCodecContext *avctx, const AV1DecContext *h = avctx->priv_data; const AV1RawFrameHeader *frame_header = h->raw_frame_header; AV1DecodePictureContext *ctx_pic = h->cur_frame.hwaccel_picture_private; + D3D12AV1DecodeContext *av1_ctx = D3D12_AV1_DECODE_CONTEXT(avctx); int offset = 0; uint32_t tg_start, tg_end; @@ -91,7 +93,11 @@ static int d3d12va_av1_decode_slice(AVCodecContext *avctx, ctx_pic->bitstream = (uint8_t *)buffer; ctx_pic->bitstream_size = size; } else { - ctx_pic->bitstream = D3D12_AV1_DECODE_CONTEXT(avctx)->bitstream_buffer; + if (ctx_pic->bitstream_size + (uint64_t)size > av1_ctx->bitstream_size) { + av_log(avctx, AV_LOG_ERROR, "Slice bitstream size exceeds internal buffer!\n"); + return AVERROR(EINVAL); + } + ctx_pic->bitstream = av1_ctx->bitstream_buffer; memcpy(ctx_pic->bitstream + ctx_pic->bitstream_size, buffer, size); tg_start = h->tg_start; tg_end = h->tg_end; @@ -180,7 +186,8 @@ static av_cold int d3d12va_av1_decode_init(AVCodecContext *avctx) return ret; if (!av1_ctx->bitstream_buffer) { - av1_ctx->bitstream_buffer = av_malloc(ff_d3d12va_get_suitable_max_bitstream_size(avctx)); + av1_ctx->bitstream_size = ff_d3d12va_get_suitable_max_bitstream_size(avctx); + av1_ctx->bitstream_buffer = av_malloc(av1_ctx->bitstream_size); if (!av1_ctx->bitstream_buffer) return AVERROR(ENOMEM); } @@ -194,6 +201,7 @@ static av_cold int d3d12va_av1_decode_uninit(AVCodecContext *avctx) if (ctx->bitstream_buffer) av_freep(&ctx->bitstream_buffer); + ctx->bitstream_size = 0; return ff_d3d12va_decode_uninit(avctx); } _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
