This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 3b939ced79655ed084e6bebc493fa8b11e9b9d8b Author: Zhao Zhili <[email protected]> AuthorDate: Thu May 7 12:46:10 2026 +0800 Commit: James Almer <[email protected]> CommitDate: Thu May 7 13:01:16 2026 +0000 avcodec/hevc: limit missing-ref fill to coded planes generate_missing_ref walked frame->f->data[] until a NULL slot, which on alpha-video frames extended to data[3] and read sps->hshift[3]/vshift[3] out of bounds. The alpha plane is produced by the alpha layer via replace_alpha_plane; the base decoder path never reads or writes it. Bound the fill loop by the SPS coded plane count. This both removes the out-of-bounds shift access and avoids an unnecessary full-frame memset of the alpha plane. Fixes: out of array read Fixes: 500770604/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6157374833623040 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg --- libavcodec/hevc/refs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevc/refs.c b/libavcodec/hevc/refs.c index 1faede4e3d..f53768f816 100644 --- a/libavcodec/hevc/refs.c +++ b/libavcodec/hevc/refs.c @@ -473,12 +473,13 @@ static HEVCFrame *generate_missing_ref(HEVCContext *s, HEVCLayerContext *l, int return NULL; if (!s->avctx->hwaccel) { + int nb_planes = l->sps->chroma_format_idc ? 3 : 1; if (!l->sps->pixel_shift) { - for (i = 0; frame->f->data[i]; i++) + for (i = 0; i < nb_planes; i++) memset(frame->f->data[i], 1 << (l->sps->bit_depth - 1), frame->f->linesize[i] * AV_CEIL_RSHIFT(l->sps->height, l->sps->vshift[i])); } else { - for (i = 0; frame->f->data[i]; i++) + for (i = 0; i < nb_planes; i++) for (y = 0; y < (l->sps->height >> l->sps->vshift[i]); y++) { uint8_t *dst = frame->f->data[i] + y * frame->f->linesize[i]; AV_WN16(dst, 1 << (l->sps->bit_depth - 1)); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
