This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 2c71a28bf0 avcodec/hdrdec: fix pixel count decrement in RLE decompress
loop
2c71a28bf0 is described below
commit 2c71a28bf0731f5fdcf9f2366ab98c31270294e4
Author: João Neves <[email protected]>
AuthorDate: Wed Apr 8 13:55:37 2026 -0700
Commit: Marton Balint <[email protected]>
CommitDate: Sun May 3 20:19:51 2026 +0000
avcodec/hdrdec: fix pixel count decrement in RLE decompress loop
The w variable counts pixels, not bytes. The non-RLE path correctly
uses w-- (one pixel = 4 bytes), but the RLE path uses w -= 4, causing
the loop to terminate after roughly 1/4 of the expected pixels.
The w -= 4 was introduced in 14e99cb472 which moved the decrement
inside the loop to fix an OOB write (clusterfuzz-5423041009549312).
The move was correct, but the decrement value should have been 1 to
match the non-RLE path.
Signed-off-by: João Neves <[email protected]>
---
libavcodec/hdrdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c
index cffa7570db..1a6935ff75 100644
--- a/libavcodec/hdrdec.c
+++ b/libavcodec/hdrdec.c
@@ -72,7 +72,7 @@ static int decompress(uint8_t *scanline, int w,
GetByteContext *gb, const uint8_
for (int i = run << rshift; i > 0 && w > 0 && scanline >= start +
4; i--) {
memcpy(scanline, scanline - 4, 4);
scanline += 4;
- w -= 4;
+ w--;
}
rshift += 8;
if (rshift > 16)
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
