dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-09 17:39:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/d3d12va_hevc: check size of frame bitstream against available buffer size

Browse Source 
(cherry picked from commit fea3f13a1c)
This commit is contained in:
Timo Rothenpieler
2026-07-09 00:40:32 +02:00
committed by ffmpeg-devel
parent 3a44bddfb9
commit b19b023f2a
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/d3d12va_hevc.c
View File

@@ -101,6 +101,7 @@ static int d3d12va_hevc_decode_slice(AVCodecContext *avctx, const uint8_t *buffe
#define START_CODE_SIZE 3
static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPUT_STREAM_ARGUMENTS *input_args, ID3D12Resource *buffer)
{
D3D12VADecodeContext *ctx = D3D12VA_DECODE_CONTEXT(avctx);
const HEVCContext *h = avctx->priv_data;
const HEVCFrame *current_picture = h->cur_frame;
HEVCDecodePictureContext *ctx_pic = current_picture->hwaccel_picture_private;
@@ -109,6 +110,7 @@ static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPU
uint8_t *mapped_data, *mapped_ptr;
DXVA_Slice_HEVC_Short *slice;
D3D12_VIDEO_DECODE_FRAME_ARGUMENT *args;
UINT bitstream_size = ctx->bitstream_size;
if (FAILED(ID3D12Resource_Map(buffer, 0, NULL, (void **)&mapped_data))) {
av_log(avctx, AV_LOG_ERROR, "Failed to map D3D12 Buffer resource!\n");
@@ -123,14 +125,22 @@ static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPU
position = slice->BSNALunitDataLocation;
size = slice->SliceBytesInBuffer;
if (START_CODE_SIZE + (uint64_t)size > bitstream_size) {
av_log(avctx, AV_LOG_ERROR, "Input frame bitstream size exceeds internal buffer!\n");
ID3D12Resource_Unmap(buffer, 0, NULL);
return AVERROR(EINVAL);
}
slice->SliceBytesInBuffer += START_CODE_SIZE;
slice->BSNALunitDataLocation = mapped_ptr - mapped_data;
*(uint32_t *)mapped_ptr = START_CODE;
mapped_ptr += START_CODE_SIZE;
bitstream_size -= START_CODE_SIZE;
memcpy(mapped_ptr, &ctx_pic->bitstream[position], size);
mapped_ptr += size;
bitstream_size -= size;
}
ID3D12Resource_Unmap(buffer, 0, NULL);