This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

commit d29ff884221042af219e53cc339a62356b061816
Author:     Sylvestre Ledru <[email protected]>
AuthorDate: Thu Aug 27 13:04:52 2026 +0200
Commit:     Niklas Haas <[email protected]>
CommitDate: Fri Aug 28 13:01:39 2026 +0000

    vulkan_av1: fix out-of-bounds write of tile_sizes
    
    The tile count limit was only checked once on entry, but tileCount is
    incremented by ff_vk_decode_add_slice() inside the loop, so a stream
    carrying more than MAX_TILES tiles writes past the end of the
    MAX_TILES-element tile_sizes array.
    
    Check the limit on each iteration, and reject at MAX_TILES rather than
    above it, since tileCount is used as the write index.
---
 libavcodec/vulkan_av1.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/libavcodec/vulkan_av1.c b/libavcodec/vulkan_av1.c
index 97a8b9816f..99bdac46e5 100644
--- a/libavcodec/vulkan_av1.c
+++ b/libavcodec/vulkan_av1.c
@@ -570,11 +570,11 @@ static int vk_av1_decode_slice(AVCodecContext *avctx,
     AV1VulkanDecodePicture *ap = s->cur_frame.hwaccel_picture_private;
     FFVulkanDecodePicture *vp = &ap->vp;
 
-    /* Too many tiles, exceeding all defined levels in the AV1 spec */
-    if (ap->av1_pic_info.tileCount > MAX_TILES)
-        return AVERROR(ENOSYS);
-
     for (int i = s->tg_start; i <= s->tg_end; i++) {
+        /* Too many tiles, exceeding all defined levels in the AV1 spec */
+        if (ap->av1_pic_info.tileCount >= MAX_TILES)
+            return AVERROR(ENOSYS);
+
         ap->tile_sizes[ap->av1_pic_info.tileCount] = 
s->tile_group_info[i].tile_size;
 
         err = ff_vk_decode_add_slice(avctx, vp,

-- 
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to