This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit d29ff884221042af219e53cc339a62356b061816 Author: Sylvestre Ledru <[email protected]> AuthorDate: Thu Aug 27 13:04:52 2026 +0200 Commit: Niklas Haas <[email protected]> CommitDate: Fri Aug 28 13:01:39 2026 +0000 vulkan_av1: fix out-of-bounds write of tile_sizes The tile count limit was only checked once on entry, but tileCount is incremented by ff_vk_decode_add_slice() inside the loop, so a stream carrying more than MAX_TILES tiles writes past the end of the MAX_TILES-element tile_sizes array. Check the limit on each iteration, and reject at MAX_TILES rather than above it, since tileCount is used as the write index. --- libavcodec/vulkan_av1.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/vulkan_av1.c b/libavcodec/vulkan_av1.c index 97a8b9816f..99bdac46e5 100644 --- a/libavcodec/vulkan_av1.c +++ b/libavcodec/vulkan_av1.c @@ -570,11 +570,11 @@ static int vk_av1_decode_slice(AVCodecContext *avctx, AV1VulkanDecodePicture *ap = s->cur_frame.hwaccel_picture_private; FFVulkanDecodePicture *vp = &ap->vp; - /* Too many tiles, exceeding all defined levels in the AV1 spec */ - if (ap->av1_pic_info.tileCount > MAX_TILES) - return AVERROR(ENOSYS); - for (int i = s->tg_start; i <= s->tg_end; i++) { + /* Too many tiles, exceeding all defined levels in the AV1 spec */ + if (ap->av1_pic_info.tileCount >= MAX_TILES) + return AVERROR(ENOSYS); + ap->tile_sizes[ap->av1_pic_info.tileCount] = s->tile_group_info[i].tile_size; err = ff_vk_decode_add_slice(avctx, vp, -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
