This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch release/5.1
in repository ffmpeg.

commit eab3192647ad489dd60947fb783c647235424f27
Author:     James Almer <[email protected]>
AuthorDate: Tue Mar 3 18:36:17 2026 -0300
Commit:     Michael Niedermayer <[email protected]>
CommitDate: Tue May 5 15:21:10 2026 +0200

    avcodec/av1dec: sync frame header and tile group behavior with CBS
    
    A new Sequence Header or a Temporal Delimiter OBU invalidate any previous 
frame
    if not yet complete (As is the case of missing Tile Groups).
    Similarly, a new Frame Header invalidates any onging Tile Group parsing.
    
    Fixes: out of array access
    Fixes: av1dec_tile_desync.mp4
    Fixes: av1dec_tile_desync_bypass.mp4
    
    Signed-off-by: James Almer <[email protected]>
    (cherry picked from commit a1496ced654e7dca9a426d263d35f9c39b7b4b88)
    Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavcodec/av1dec.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c
index 600b022626..4a3ad376a8 100644
--- a/libavcodec/av1dec.c
+++ b/libavcodec/av1dec.c
@@ -1042,6 +1042,8 @@ static int av1_decode_frame(AVCodecContext *avctx, 
AVFrame *frame,
             }
 
             s->raw_seq = &obu->obu.sequence_header;
+            s->raw_frame_header = NULL;
+            raw_tile_group      = NULL;
 
             ret = set_context_with_sequence(avctx, s->raw_seq);
             if (ret < 0) {
@@ -1091,6 +1093,8 @@ static int av1_decode_frame(AVCodecContext *avctx, 
AVFrame *frame,
                 goto end;
             }
 
+            raw_tile_group      = NULL;
+
             if (unit->type == AV1_OBU_FRAME)
                 s->raw_frame_header = &obu->obu.frame.header;
             else
@@ -1170,8 +1174,11 @@ static int av1_decode_frame(AVCodecContext *avctx, 
AVFrame *frame,
                 }
             }
             break;
-        case AV1_OBU_TILE_LIST:
         case AV1_OBU_TEMPORAL_DELIMITER:
+            s->raw_frame_header = NULL;
+            raw_tile_group      = NULL;
+        // fall-through
+        case AV1_OBU_TILE_LIST:
         case AV1_OBU_PADDING:
         case AV1_OBU_METADATA:
             break;

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to