This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 90f1f797aa lavc/vvc: Error on inter slice with no reference pics
90f1f797aa is described below
commit 90f1f797aa9231375e4858df523fbfeda89bfd79
Author: Frank Plowman <[email protected]>
AuthorDate: Wed Dec 24 15:35:06 2025 +0000
Commit: James Almer <[email protected]>
CommitDate: Sat Dec 27 15:14:16 2025 +0000
lavc/vvc: Error on inter slice with no reference pics
The semantics of sh_num_ref_idx_active_minus1[ i ] state that
When the current slice is a P slice, the value of NumRefIdxActive[ 0 ]
shall be greater than 0.
When the current slice is a B slice, both NumRefIdxActive[ 0 ] and
NumRefIdxActive[ 1 ] shall be greater than 0.
Fixes: use of uninitialized memory
Fixes:
449549597/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5600497089445888
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reported-by: Michael Niedermayer [email protected]
---
libavcodec/cbs_h266_syntax_template.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/cbs_h266_syntax_template.c
b/libavcodec/cbs_h266_syntax_template.c
index 8b337c75d0..d9a65a9c19 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -3248,6 +3248,12 @@ static int FUNC(slice_header) (CodedBitstreamContext
*ctx, RWContext *rw,
FFMIN(ref_pic_lists->rpl_ref_list[i].num_ref_entries,
pps->pps_num_ref_idx_default_active_minus1[i] + 1);
}
+
+ if (current->num_ref_idx_active[i] <= 0) {
+ av_log(ctx->log_ctx, AV_LOG_ERROR,
+ "Inter slice but no reference pictures available for
RPL%d.\n", i);
+ return AVERROR_INVALIDDATA;
+ }
} else {
current->num_ref_idx_active[i] = 0;
}
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
