From 8553e6ef5785ecc15733da84b49dea85d7b59dc1 Mon Sep 17 00:00:00 2001 From: Kenan Alghythee Date: Wed, 22 Jul 2026 19:20:46 +0200 Subject: [PATCH] avcodec/cbs_av1: pad the ITU-T T.35 payload buffer Fixes: out of array access Fixes: SUcVEyk7r3Gc Found-by: Kenan Alghythee (cherry picked from commit e2bc6d88cd68184288c16570e04881c3a426a05a) Signed-off-by: Michael Niedermayer --- libavcodec/cbs_av1_syntax_template.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/cbs_av1_syntax_template.c b/libavcodec/cbs_av1_syntax_template.c index f3d84f3c05..e6fd4ff678 100644 --- a/libavcodec/cbs_av1_syntax_template.c +++ b/libavcodec/cbs_av1_syntax_template.c @@ -2011,10 +2011,12 @@ static int FUNC(metadata_itut_t35)(CodedBitstreamContext *ctx, RWContext *rw, // be arbitrarily many trailing zeroes so we need to read through twice. current->payload_size = cbs_av1_get_payload_bytes_left(rw); - current->payload_ref = av_buffer_alloc(current->payload_size); + current->payload_ref = av_buffer_alloc(current->payload_size + + AV_INPUT_BUFFER_PADDING_SIZE); if (!current->payload_ref) return AVERROR(ENOMEM); current->payload = current->payload_ref->data; + memset(current->payload + current->payload_size, 0, AV_INPUT_BUFFER_PADDING_SIZE); #endif for (i = 0; i < current->payload_size; i++)