This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit e058af88abd1bc2375f27bad130508ed485c7462 Author: Kai Martin <[email protected]> AuthorDate: Thu Sep 17 04:41:00 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Thu Sep 17 23:08:43 2026 +0200 avcodec/vulkan_hevc: bound the reference count in vk_hevc_start_frame Fixes: out of array write Fixes: 9vZSLhhnp3ps Found-by: Kai Martin, KG3N Research --- libavcodec/vulkan_hevc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavcodec/vulkan_hevc.c b/libavcodec/vulkan_hevc.c index 0e178da7f0..3701227bf3 100644 --- a/libavcodec/vulkan_hevc.c +++ b/libavcodec/vulkan_hevc.c @@ -757,6 +757,13 @@ static int vk_hevc_start_frame(AVCodecContext *avctx, continue; } + if (nb_refs >= HEVC_MAX_REFS) { + av_log(avctx, AV_LOG_ERROR, + "Too many reference frames in DPB: %d >= %d\n", + nb_refs, HEVC_MAX_REFS); + return AVERROR_INVALIDDATA; + } + err = vk_hevc_fill_pict(avctx, &hp->ref_src[idx], &vp->ref_slots[idx], &vp->refs[idx], &hp->vkh265_refs[idx], &hp->h265_refs[idx], (HEVCFrame *)ref, 0, i); -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
