This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 8d58fe1ecc25204c6cb8858c4f821d1d8d6f0d5f Author: Kai Martin <[email protected]> AuthorDate: Thu Sep 17 04:41:00 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Fri Sep 18 00:48:15 2026 +0200 avcodec/vulkan_hevc: bound the reference count in vk_hevc_start_frame Fixes: out of array write Fixes: 9vZSLhhnp3ps Found-by: Kai Martin, KG3N Research (cherry picked from commit e058af88abd1bc2375f27bad130508ed485c7462) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/vulkan_hevc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavcodec/vulkan_hevc.c b/libavcodec/vulkan_hevc.c index 9b9264f1cd..a837e57ba9 100644 --- a/libavcodec/vulkan_hevc.c +++ b/libavcodec/vulkan_hevc.c @@ -757,6 +757,13 @@ static int vk_hevc_start_frame(AVCodecContext *avctx, continue; } + if (nb_refs >= HEVC_MAX_REFS) { + av_log(avctx, AV_LOG_ERROR, + "Too many reference frames in DPB: %d >= %d\n", + nb_refs, HEVC_MAX_REFS); + return AVERROR_INVALIDDATA; + } + err = vk_hevc_fill_pict(avctx, &hp->ref_src[idx], &vp->ref_slots[idx], &vp->refs[idx], &hp->vkh265_refs[idx], &hp->h265_refs[idx], (HEVCFrame *)ref, 0, i); -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
