This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit a024f8c5413d2c7e653d1843547050319c33fbe0 Author: Chun-Min Chang <[email protected]> AuthorDate: Thu Jul 16 16:57:49 2026 -0700 Commit: michaelni <[email protected]> CommitDate: Sat Sep 12 03:20:09 2026 +0000 avcodec/vp9: unref next_refs in vp9_decode_flush vp9_decode_flush() releases s->s.frames[], s->s.refs[] and s->s.ref_frames[] but leaves s->next_refs[] referenced. Under frame threading, vp9_decode_update_thread_context() seeds a worker's s->s.refs[] from the source worker's next_refs[] (not from its refs[]). The pre-flush next_refs therefore survive a flush and can be resurrected into a worker's refs[] afterwards, letting a subsequent inter frame pass the reference-availability check and decode against references that no longer exist. Unref s->next_refs[] alongside s->s.refs[] so that flushing fully drops the decoder's reference state. Fixes: heap out-of-bounds read and write after avcodec_flush_buffers() Fixes: 34c2zQaUquOl Found-by: Mozilla's bugmon automation, reviewed and reported by Chun-Min Chang <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/vp9.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/vp9.c b/libavcodec/vp9.c index 7be733a0da..ce4e197c9d 100644 --- a/libavcodec/vp9.c +++ b/libavcodec/vp9.c @@ -1866,6 +1866,7 @@ static av_cold void vp9_decode_flush(AVCodecContext *avctx) for (i = 0; i < 8; i++) { ff_progress_frame_unref(&s->s.refs[i]); + ff_progress_frame_unref(&s->next_refs[i]); vp9_frame_unref(&s->s.ref_frames[i]); } -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
