dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-09 01:21:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/cbs_av1: pad the ITU-T T.35 payload buffer

Browse Source 
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <kalghy2@uic.edu>
(cherry picked from commit e2bc6d88cd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Kenan Alghythee
2026-07-22 19:20:46 +02:00
committed by Michael Niedermayer
parent c22667d0fd
commit 8553e6ef57
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/cbs_av1_syntax_template.c
View File

@@ -2011,10 +2011,12 @@ static int FUNC(metadata_itut_t35)(CodedBitstreamContext *ctx, RWContext *rw,
// be arbitrarily many trailing zeroes so we need to read through twice.
current->payload_size = cbs_av1_get_payload_bytes_left(rw);
current->payload_ref = av_buffer_alloc(current->payload_size);
current->payload_ref = av_buffer_alloc(current->payload_size +
AV_INPUT_BUFFER_PADDING_SIZE);
if (!current->payload_ref)
return AVERROR(ENOMEM);
current->payload = current->payload_ref->data;
memset(current->payload + current->payload_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
#endif
for (i = 0; i < current->payload_size; i++)