PR #23773 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773.patch
Fixes: out of array access Fixes: tdsc_poc/ffmpeg-tdsc-linesize-report/poc.avi / gen_poc.py Fixes: tdsc_resize_jpeg_oob.avi / tdsc-resize-stale-linesize-jpeg-oob-generate-poc.py Fixes: p9xG4xGf9P7H Fixes: HQL7a1WgTdHZ Found-by: Cloud-LHY / Clouditera Security, Z.ai Security, NSFOCUS Found-by: Adrian Junge (vurlo) >From 574961b54fb2fa5affb8027026d99a4c399d49ce Mon Sep 17 00:00:00 2001 From: Cloud-LHY <[email protected]> Date: Fri, 10 Jul 2026 04:07:04 +0200 Subject: [PATCH] avcodec/tdsc: unref the reference frame before reallocating on size change Fixes: out of array access Fixes: tdsc_poc/ffmpeg-tdsc-linesize-report/poc.avi / gen_poc.py Fixes: tdsc_resize_jpeg_oob.avi / tdsc-resize-stale-linesize-jpeg-oob-generate-poc.py Fixes: p9xG4xGf9P7H Fixes: HQL7a1WgTdHZ Found-by: Cloud-LHY / Clouditera Security, Z.ai Security, NSFOCUS Found-by: Adrian Junge (vurlo) --- libavcodec/tdsc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c index ca9dd0f0a6..102b4ae966 100644 --- a/libavcodec/tdsc.c +++ b/libavcodec/tdsc.c @@ -485,11 +485,15 @@ static int tdsc_parse_tdsf(AVCodecContext *avctx, int number_tiles) return ret; init_refframe = 1; } - ctx->refframe->width = ctx->width = w; - ctx->refframe->height = ctx->height = h; + ctx->width = w; + ctx->height = h; /* Allocate the reference frame if not already done or on size change */ if (init_refframe) { + av_frame_unref(ctx->refframe); + ctx->refframe->format = avctx->pix_fmt; + ctx->refframe->width = w; + ctx->refframe->height = h; ret = av_frame_get_buffer(ctx->refframe, 0); if (ret < 0) return ret; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
