dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-13 17:07:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/hevc: limit missing-ref fill to coded planes

Browse Source 
generate_missing_ref walked frame->f->data[] until a NULL slot, which
on alpha-video frames extended to data[3] and read
sps->hshift[3]/vshift[3] out of bounds.

The alpha plane is produced by the alpha layer via
replace_alpha_plane; the base decoder path never reads or writes it.
Bound the fill loop by the SPS coded plane count. This both removes
the out-of-bounds shift access and avoids an unnecessary full-frame
memset of the alpha plane.

Fixes: out of array read
Fixes: 500770604/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6157374833623040
(cherry picked from commit 3b939ced79)
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit afe5c07ad7bf973bfa0e490fbc8e50c2432d819d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Zhao Zhili
2026-05-07 12:46:10 +08:00
committed by Michael Niedermayer
parent cdf60f13b0
commit d30e95b93b
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/hevc_refs.c
View File

@@ -427,12 +427,14 @@ static HEVCFrame *generate_missing_ref(HEVCContext *s, int poc)
return NULL;
if (!s->avctx->hwaccel) {
int nb_planes = s->ps.sps->chroma_format_idc ? 3 : 1;
if (!s->ps.sps->pixel_shift) {
for (i = 0; frame->frame->data[i]; i++)
for (i = 0; i < nb_planes; i++)
memset(frame->frame->data[i], 1 << (s->ps.sps->bit_depth - 1),
frame->frame->linesize[i] * AV_CEIL_RSHIFT(s->ps.sps->height, s->ps.sps->vshift[i]));
} else {
for (i = 0; frame->frame->data[i]; i++)
for (i = 0; i < nb_planes; i++)
for (y = 0; y < (s->ps.sps->height >> s->ps.sps->vshift[i]); y++) {
uint8_t *dst = frame->frame->data[i] + y * frame->frame->linesize[i];
AV_WN16(dst, 1 << (s->ps.sps->bit_depth - 1));