PR #23726 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23726 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23726.patch
Fixes: memleak Fixes: 518575619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5161396783611904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg# Summary of changes >From 936d098c97eb21c432edaca6aa7df0ba6f0e4e55 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 7 Jul 2026 02:45:49 +0200 Subject: [PATCH 1/2] avcodec/vvc/dec: merge the SAO and ALF pixel buffer tab loops Both loops iterate over the same components and compute the same per-component width and height. The order of tabs within a TabList does not matter, so build all pixel buffer tabs in a single loop. --- libavcodec/vvc/dec.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c index 561323f123..ebe8e96272 100644 --- a/libavcodec/vvc/dec.c +++ b/libavcodec/vvc/dec.c @@ -248,14 +248,9 @@ static void pixel_buffer_nz_tl_init(TabList *l, VVCFrameContext *fc) for (int c_idx = 0; c_idx < c_end; c_idx++) { const int w = width >> (sps ? sps->hshift[c_idx] : 0); const int h = height >> (sps ? sps->vshift[c_idx] : 0); + const int border_pixels = c_idx ? ALF_BORDER_CHROMA : ALF_BORDER_LUMA; TL_ADD(sao_pixel_buffer_h[c_idx], (w * 2 * ctu_height) << ps); TL_ADD(sao_pixel_buffer_v[c_idx], (h * 2 * ctu_width) << ps); - } - - for (int c_idx = 0; c_idx < c_end; c_idx++) { - const int w = width >> (sps ? sps->hshift[c_idx] : 0); - const int h = height >> (sps ? sps->vshift[c_idx] : 0); - const int border_pixels = c_idx ? ALF_BORDER_CHROMA : ALF_BORDER_LUMA; for (int i = 0; i < 2; i++) { TL_ADD(alf_pixel_buffer_h[c_idx][i], (w * border_pixels * ctu_height) << ps); TL_ADD(alf_pixel_buffer_v[c_idx][i], h * ALF_PADDING_SIZE * ctu_width); -- 2.52.0 >From 92e7d8128f7978571c3108514ed2f969c5c7f8a0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 7 Jul 2026 02:46:20 +0200 Subject: [PATCH 2/2] avcodec/vvc/dec: fix pixel buffer tab leak on chroma format change Fixes: memleak Fixes: 518575619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5161396783611904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg --- libavcodec/vvc/dec.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c index ebe8e96272..926288e07b 100644 --- a/libavcodec/vvc/dec.c +++ b/libavcodec/vvc/dec.c @@ -86,6 +86,8 @@ static int tl_create(TabList *l) for (int i = 0; i < l->nb_tabs; i++) { Tab *t = l->tabs + i; + if (!t->size) + continue; *t->tab = l->zero ? av_mallocz(t->size) : av_malloc(t->size); if (!*t->tab) return AVERROR(ENOMEM); @@ -245,9 +247,12 @@ static void pixel_buffer_nz_tl_init(TabList *l, VVCFrameContext *fc) tl_init(l, 0, changed); - for (int c_idx = 0; c_idx < c_end; c_idx++) { - const int w = width >> (sps ? sps->hshift[c_idx] : 0); - const int h = height >> (sps ? sps->vshift[c_idx] : 0); + /* Add size 0 tabs for the components beyond c_end, so tl_free() frees + * tabs allocated under a previous, larger chroma format. */ + for (int c_idx = 0; c_idx < VVC_MAX_SAMPLE_ARRAYS; c_idx++) { + const int active = c_idx < c_end; + const int w = active ? width >> (sps ? sps->hshift[c_idx] : 0) : 0; + const int h = active ? height >> (sps ? sps->vshift[c_idx] : 0) : 0; const int border_pixels = c_idx ? ALF_BORDER_CHROMA : ALF_BORDER_LUMA; TL_ADD(sao_pixel_buffer_h[c_idx], (w * 2 * ctu_height) << ps); TL_ADD(sao_pixel_buffer_v[c_idx], (h * 2 * ctu_width) << ps); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
