From 507e9ad2862619b66046ed7381296d4e5d3c8188 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 2 Oct 2026 03:02:43 +0200 Subject: [PATCH] avcodec/vvc/dec: require all slices of a frame to use the same PH and PPS The testcases reproduce since b0c77e5a12. Fixes: out of array read Fixes: fAak9zecyttL/testcase/poc.vvc Fixes: fAak9zecyttL/testcase/poc-entry-points.vvc Fixes: fAak9zecyttL Found-by: mzfr --- libavcodec/vvc/dec.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c index 8ed9e1e4b8..f69fa99c6d 100644 --- a/libavcodec/vvc/dec.c +++ b/libavcodec/vvc/dec.c @@ -965,6 +965,15 @@ static int decode_slice(VVCContext *s, VVCFrameContext *fc, AVBufferRef *buf_ref ret = frame_setup(fc, s); if (ret < 0) return ret; + } else { + const H266RawSlice *first = fc->slices[0]->ref; + const H266RawSlice *slice = sc->ref; + + if (slice->ph != first->ph || slice->pps != first->pps) { + av_log(fc->log_ctx, AV_LOG_ERROR, + "Slice does not use the PH and PPS of the first slice.\n"); + return AVERROR_INVALIDDATA; + } } ret = slice_start(sc, s, fc, unit, is_first_slice);