This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 1fd404c6ba57d469341857345a6f15ff97c615c2 Author: Lynne <[email protected]> AuthorDate: Sat Nov 7 16:47:43 2026 +0800 Commit: Lynne <[email protected]> CommitDate: Sat Nov 7 22:20:30 2026 +0800 vulkan: keep the plain bitstream reader within its buffer The reader without shared memory refills straight from its buffer, with no regard for the end. Corrupt data, or a decoder that has lost track of the bitstream, makes it read on past the end into memory that may not be mapped: an APV stream which threw off the decoder made an RX 6900 XT fault and lose the device. Read words past the end of the buffer from the end instead, as the shared memory reader does with its lines. Reads now stay within 8 bytes of the end, which valid streams already reach. This costs up to 2% in APV decoding, and nothing measurable in FFV1's Golomb mode. --- libavcodec/vulkan/common.glsl | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavcodec/vulkan/common.glsl b/libavcodec/vulkan/common.glsl index 27a38531a9..27fd0b0ff2 100644 --- a/libavcodec/vulkan/common.glsl +++ b/libavcodec/vulkan/common.glsl @@ -254,9 +254,12 @@ struct GetBitContext { }; #ifndef GET_BITS_SMEM +/* Words past the end of the buffer are read from its end instead, so corrupt + * data cannot run the reader off into unmapped memory. */ #define LOAD64() \ { \ - u8vec4buf ptr = u8vec4buf(gb.buf); \ + uint64_t addr = min(gb.buf, gb.buf_end); \ + u8vec4buf ptr = u8vec4buf(addr); \ uint32_t rf1 = pack32((ptr[0].v).wzyx); \ uint32_t rf2 = pack32((ptr[1].v).wzyx); \ gb.buf += 8; \ @@ -266,7 +269,7 @@ struct GetBitContext { #define RELOAD32() \ { \ - u8vec4buf ptr = u8vec4buf(gb.buf); \ + u8vec4buf ptr = u8vec4buf(min(gb.buf, gb.buf_end)); \ uint32_t rf = pack32((ptr[0].v).wzyx); \ gb.buf += 4; \ gb.bits = uint64_t(rf) << (32 - gb.bits_valid) | gb.bits; \ -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
