From a1496ced654e7dca9a426d263d35f9c39b7b4b88 Mon Sep 17 00:00:00 2001 From: James Almer Date: Tue, 3 Mar 2026 18:36:17 -0300 Subject: [PATCH] avcodec/av1dec: sync frame header and tile group behavior with CBS A new Sequence Header or a Temporal Delimiter OBU invalidate any previous frame if not yet complete (As is the case of missing Tile Groups). Similarly, a new Frame Header invalidates any onging Tile Group parsing. Fixes: out of array access Fixes: av1dec_tile_desync.mp4 Fixes: av1dec_tile_desync_bypass.mp4 Signed-off-by: James Almer --- libavcodec/av1dec.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c index 1dffc7c1b9..ba8442077a 100644 --- a/libavcodec/av1dec.c +++ b/libavcodec/av1dec.c @@ -1307,6 +1307,8 @@ static int av1_receive_frame_internal(AVCodecContext *avctx, AVFrame *frame) av_refstruct_replace(&s->seq_ref, unit->content_ref); s->raw_seq = &obu->obu.sequence_header; + s->raw_frame_header = NULL; + raw_tile_group = NULL; ret = set_context_with_sequence(avctx, s->raw_seq); if (ret < 0) { @@ -1343,6 +1345,8 @@ static int av1_receive_frame_internal(AVCodecContext *avctx, AVFrame *frame) av_refstruct_replace(&s->header_ref, unit->content_ref); + raw_tile_group = NULL; + if (unit->type == AV1_OBU_FRAME) s->raw_frame_header = &obu->obu.frame.header; else @@ -1415,8 +1419,11 @@ static int av1_receive_frame_internal(AVCodecContext *avctx, AVFrame *frame) } } break; - case AV1_OBU_TILE_LIST: case AV1_OBU_TEMPORAL_DELIMITER: + s->raw_frame_header = NULL; + raw_tile_group = NULL; + // fall-through + case AV1_OBU_TILE_LIST: case AV1_OBU_PADDING: break; case AV1_OBU_METADATA: