PR #24548 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24548 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24548.patch
Fixes: out of array write Fixes: 9vZSLhhnp3ps Found-by: Kai Martin, KG3N Research >From 0a0e74956ae155274bd499e08f2a6f781ab7c8ad Mon Sep 17 00:00:00 2001 From: Kai Martin <[email protected]> Date: Thu, 17 Sep 2026 04:41:00 +0200 Subject: [PATCH] avcodec/vulkan_hevc: bound the reference count in vk_hevc_start_frame Fixes: out of array write Fixes: 9vZSLhhnp3ps Found-by: Kai Martin, KG3N Research --- libavcodec/vulkan_hevc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavcodec/vulkan_hevc.c b/libavcodec/vulkan_hevc.c index 0e178da7f0..3701227bf3 100644 --- a/libavcodec/vulkan_hevc.c +++ b/libavcodec/vulkan_hevc.c @@ -757,6 +757,13 @@ static int vk_hevc_start_frame(AVCodecContext *avctx, continue; } + if (nb_refs >= HEVC_MAX_REFS) { + av_log(avctx, AV_LOG_ERROR, + "Too many reference frames in DPB: %d >= %d\n", + nb_refs, HEVC_MAX_REFS); + return AVERROR_INVALIDDATA; + } + err = vk_hevc_fill_pict(avctx, &hp->ref_src[idx], &vp->ref_slots[idx], &vp->refs[idx], &hp->vkh265_refs[idx], &hp->h265_refs[idx], (HEVCFrame *)ref, 0, i); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
