This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

commit 7a55e7d4f3698bb72d26aba8f5a41559f8ee6612
Author:     Gyula Sebok <[email protected]>
AuthorDate: Sat Oct 31 19:18:51 2026 +0100
Commit:     Martin Storsjö <[email protected]>
CommitDate: Tue Nov 3 18:33:02 2026 +0000

    avcodec/utvideodec: Fix over-read of the add_left_pred source buffer
    
    The buffer only had 8 bytes of padding, while the SIMD versions of
    add_left_pred read whole vectors, up to the next multiple of 32 bytes
    with AVX2.
    
    Signed-off-by: Gyula Sebok <[email protected]>
---
 libavcodec/utvideodec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c
index e9321241f0..ddfaa20005 100644
--- a/libavcodec/utvideodec.c
+++ b/libavcodec/utvideodec.c
@@ -30,6 +30,7 @@
 #define CACHED_BITSTREAM_READER !ARCH_X86_32
 #define UNCHECKED_BITSTREAM_READER 1
 
+#include "libavutil/cpu.h"
 #include "libavutil/intreadwrite.h"
 #include "libavutil/mem.h"
 #include "libavutil/pixdesc.h"
@@ -1057,7 +1058,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
         return AVERROR_INVALIDDATA;
     }
 
-    c->buffer = av_calloc(avctx->width + 8, c->pro?2:1);
+    /* add_left_pred reads whole vectors. */
+    c->buffer = av_calloc(avctx->width + av_cpu_max_align(), c->pro ? 2 : 1);
     if (!c->buffer)
         return AVERROR(ENOMEM);
 

-- 
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to