This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.1 in repository ffmpeg.
commit 431807ae937aaf4ffbc900d8cb5d42d3017af815 Author: Kenan Alghythee <[email protected]> AuthorDate: Wed Jul 22 19:20:46 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sat Sep 19 14:26:59 2026 +0200 avcodec/cbs_av1: pad the ITU-T T.35 payload buffer Fixes: out of array access Fixes: SUcVEyk7r3Gc Found-by: Kenan Alghythee <[email protected]> (cherry picked from commit e2bc6d88cd68184288c16570e04881c3a426a05a) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cbs_av1_syntax_template.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/cbs_av1_syntax_template.c b/libavcodec/cbs_av1_syntax_template.c index 74ab460413..0997a1945d 100644 --- a/libavcodec/cbs_av1_syntax_template.c +++ b/libavcodec/cbs_av1_syntax_template.c @@ -2010,10 +2010,12 @@ static int FUNC(metadata_itut_t35)(CodedBitstreamContext *ctx, RWContext *rw, // be arbitrarily many trailing zeroes so we need to read through twice. current->payload_size = cbs_av1_get_payload_bytes_left(rw); - current->payload_ref = av_buffer_alloc(current->payload_size); + current->payload_ref = av_buffer_alloc(current->payload_size + + AV_INPUT_BUFFER_PADDING_SIZE); if (!current->payload_ref) return AVERROR(ENOMEM); current->payload = current->payload_ref->data; + memset(current->payload + current->payload_size, 0, AV_INPUT_BUFFER_PADDING_SIZE); #endif for (i = 0; i < current->payload_size; i++) -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
