dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-07 08:31:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/tdsc: unref the reference frame before reallocating on size change

Browse Source 
Fixes: out of array access
Fixes: tdsc_poc/ffmpeg-tdsc-linesize-report/poc.avi / gen_poc.py
Fixes: tdsc_resize_jpeg_oob.avi / tdsc-resize-stale-linesize-jpeg-oob-generate-poc.py
Fixes: p9xG4xGf9P7H
Fixes: HQL7a1WgTdHZ
Found-by: Cloud-LHY / Clouditera Security, Z.ai Security, NSFOCUS
Found-by: Adrian Junge (vurlo)
This commit is contained in:
Cloud-LHY
2026-07-10 04:07:04 +02:00
committed by michaelni
parent 90436de5e1
commit fd3ee52fab
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/tdsc.c
View File

@@ -485,11 +485,15 @@ static int tdsc_parse_tdsf(AVCodecContext *avctx, int number_tiles)
return ret;
init_refframe = 1;
}
ctx->refframe->width = ctx->width = w;
ctx->refframe->height = ctx->height = h;
ctx->width = w;
ctx->height = h;
/* Allocate the reference frame if not already done or on size change */
if (init_refframe) {
av_frame_unref(ctx->refframe);
ctx->refframe->format = avctx->pix_fmt;
ctx->refframe->width = w;
ctx->refframe->height = h;
ret = av_frame_get_buffer(ctx->refframe, 0);
if (ret < 0)
return ret;