dilim/FFmpeg
1
0 Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-11-06 05:17:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/cbs_sei: clear the message slot handed out by ff_cbs_sei_list_add()

Browse Source 
Fixes: heap-use-after-free
Fixes: YtyT0QH1InrQ
Fixes: ANT-2026-13DK7NZD
Fixes: poc.264
Found-by: Claude and Ada Logics

Use after free Replicated through UnModified FFmpeg with ASAN
This commit is contained in:
Michael Niedermayer authored and michaelni committed 2026-11-05 23:03:11 +00:00
1 parent 3092ee5a9c
commit 2c515eea07
1 file changed
+1 -4
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/cbs_sei.c
+1 -4
View File
@@ -279,11 +279,8 @@ int ff_cbs_sei_list_add(SEIRawMessageList *list)
list->messages = ptr;
list->nb_messages_allocated = new_count;
// Zero the newly-added entries.
memset(list->messages + old_count, 0,
(new_count - old_count) * sizeof(*list->messages));
}
memset(&list->messages[list->nb_messages], 0, sizeof(*list->messages));
++list->nb_messages;
return 0;
}