avcodec/mpeg4videodec: Copy studio_profile in frame-thread context update

Fixes: out of array access
Fixes: poc.m4v / make_poc.py
Fixes: 93KU7grvT7G1
Fixes: f9d3841ae6 (mpeg4video: Add support for MPEG-4 Simple Studio Profile.)
Found-by: VulnForge Security Research Team <haoyuliu@clouditera.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-06-24 03:43:32 +02:00
committed by michaelni
parent 56309e476a
commit 19035c35fc

View File

@@ -3923,6 +3923,7 @@ static int mpeg4_update_thread_context(AVCodecContext *dst,
s->cplx_estimation_trash_p = s1->cplx_estimation_trash_p;
s->cplx_estimation_trash_b = s1->cplx_estimation_trash_b;
s->rgb = s1->rgb;
s->h.c.studio_profile = s1->h.c.studio_profile;
s->h.skipped_last_frame = s1->h.skipped_last_frame;
s->h.padding_bug_score = s1->h.padding_bug_score; // FIXME: racy