This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit fea3f13a1cc5395b0ab6db95dd20e7cf6023c311 Author: Timo Rothenpieler <[email protected]> AuthorDate: Thu Jul 9 00:40:32 2026 +0200 Commit: Timo Rothenpieler <[email protected]> CommitDate: Mon Jul 13 21:13:25 2026 +0200 avcodec/d3d12va_hevc: check size of frame bitstream against available buffer size --- libavcodec/d3d12va_hevc.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libavcodec/d3d12va_hevc.c b/libavcodec/d3d12va_hevc.c index e72d49b7d9..1bf1faf9cb 100644 --- a/libavcodec/d3d12va_hevc.c +++ b/libavcodec/d3d12va_hevc.c @@ -101,6 +101,7 @@ static int d3d12va_hevc_decode_slice(AVCodecContext *avctx, const uint8_t *buffe #define START_CODE_SIZE 3 static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPUT_STREAM_ARGUMENTS *input_args, ID3D12Resource *buffer) { + D3D12VADecodeContext *ctx = D3D12VA_DECODE_CONTEXT(avctx); const HEVCContext *h = avctx->priv_data; const HEVCFrame *current_picture = h->cur_frame; HEVCDecodePictureContext *ctx_pic = current_picture->hwaccel_picture_private; @@ -109,6 +110,7 @@ static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPU uint8_t *mapped_data, *mapped_ptr; DXVA_Slice_HEVC_Short *slice; D3D12_VIDEO_DECODE_FRAME_ARGUMENT *args; + UINT bitstream_size = ctx->bitstream_size; if (FAILED(ID3D12Resource_Map(buffer, 0, NULL, (void **)&mapped_data))) { av_log(avctx, AV_LOG_ERROR, "Failed to map D3D12 Buffer resource!\n"); @@ -123,14 +125,22 @@ static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPU position = slice->BSNALunitDataLocation; size = slice->SliceBytesInBuffer; + if (START_CODE_SIZE + (uint64_t)size > bitstream_size) { + av_log(avctx, AV_LOG_ERROR, "Input frame bitstream size exceeds internal buffer!\n"); + ID3D12Resource_Unmap(buffer, 0, NULL); + return AVERROR(EINVAL); + } + slice->SliceBytesInBuffer += START_CODE_SIZE; slice->BSNALunitDataLocation = mapped_ptr - mapped_data; *(uint32_t *)mapped_ptr = START_CODE; mapped_ptr += START_CODE_SIZE; + bitstream_size -= START_CODE_SIZE; memcpy(mapped_ptr, &ctx_pic->bitstream[position], size); mapped_ptr += size; + bitstream_size -= size; } ID3D12Resource_Unmap(buffer, 0, NULL); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
