From cc82fdfbd4cacef2018f1dadb29330bf80c4fe87 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 30 Jul 2026 01:41:06 +0200
Subject: [PATCH] avcodec/vulkan/ffv1_dec_setup: reject a remap that produces
 zero entries

---
 libavcodec/vulkan/ffv1_dec_setup.comp.glsl | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/libavcodec/vulkan/ffv1_dec_setup.comp.glsl b/libavcodec/vulkan/ffv1_dec_setup.comp.glsl
index 1debd9b992..47a5b42bc6 100644
--- a/libavcodec/vulkan/ffv1_dec_setup.comp.glsl
+++ b/libavcodec/vulkan/ffv1_dec_setup.comp.glsl
@@ -91,7 +91,7 @@ int decode_current_mul(uint ctx_off, int mul_count, int64_t i)
     return mul[ndx];
 }
 
-void decode_remap(uint slice_idx, inout SliceContext sc)
+bool decode_remap(uint slice_idx, inout SliceContext sc)
 {
     uint end = uint(rct_offset - 1);
     uint flip_mask = end ^ (end >> 1);
@@ -106,10 +106,8 @@ void decode_remap(uint slice_idx, inout SliceContext sc)
             rc_state[k] = uint8_t(128);
 
         int mul_count = int(get_usymbol(0));
-        if (mul_count > 4096) {
-            sc.remap_count[p] = j;
-            return;
-        }
+        if (mul_count > 4096)
+            return true;
         for (int mi = 0; mi < mul_count; mi++)
             mul[mi] = -1;
         mul[mul_count] = 1;
@@ -131,10 +129,8 @@ void decode_remap(uint slice_idx, inout SliceContext sc)
                 run1--;
                 if (current_mul > 1) {
                     int delta = get_isymbol(uint(lu*3 + 1)*CONTEXT_SIZE);
-                    if (delta <= -current_mul || delta > current_mul/2) {
-                        sc.remap_count[p] = j;
-                        return;
-                    }
+                    if (delta <= -current_mul || delta > current_mul/2)
+                        return true;
                     i += int64_t(current_mul - 1 + delta);
                 }
                 if (i - 1 >= int64_t(end))
@@ -148,8 +144,12 @@ void decode_remap(uint slice_idx, inout SliceContext sc)
                 i += int64_t(current_mul);
             lu ^= int(run == 0u);
         }
+        if (j == 0)
+            return true;
         sc.remap_count[p] = j;
     }
+
+    return false;
 }
 
 bool decode_slice_header(uint slice_idx, inout SliceContext sc)
@@ -200,8 +200,8 @@ bool decode_slice_header(uint slice_idx, inout SliceContext sc)
 
         if (micro_version >= 4) {
             sc.remap = get_usymbol(0);
-            if (sc.remap != 0)
-                decode_remap(slice_idx, sc);
+            if (sc.remap != 0 && decode_remap(slice_idx, sc))
+                return true;
         }
     }