PR #21783 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21783 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21783.patch
Fixes: Assertion n>0 && n<=25 failed at ./libavcodec/get_bits.h:3 Fixes: 472463689/clusterfuzz-testcase-minimized-ffmpeg_dem_HXVS_fuzzer-6012944883449856 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From 380104efd0590f7447958d9d4038c7a47efeea6f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 16 Feb 2026 01:38:53 +0100 Subject: [PATCH] avcodec/hevc/ps: Check bit_depth_cm in/out relation Fixes: Assertion n>0 && n<=25 failed at ./libavcodec/get_bits.h:3 Fixes: 472463689/clusterfuzz-testcase-minimized-ffmpeg_dem_HXVS_fuzzer-6012944883449856 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/hevc/ps.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/hevc/ps.c b/libavcodec/hevc/ps.c index 9f7a61e794..46b38564d5 100644 --- a/libavcodec/hevc/ps.c +++ b/libavcodec/hevc/ps.c @@ -1826,6 +1826,10 @@ static int colour_mapping_table(GetBitContext *gb, AVCodecContext *avctx, HEVCPP pps->luma_bit_depth_cm_output = get_ue_golomb(gb) + 8; pps->chroma_bit_depth_cm_output = get_ue_golomb(gb) + 8; + if ( pps-> luma_bit_depth_cm_output < pps-> luma_bit_depth_cm_input + || pps->chroma_bit_depth_cm_output < pps->chroma_bit_depth_cm_input) + return AVERROR_INVALIDDATA; + pps->cm_res_quant_bits = get_bits(gb, 2); pps->cm_delta_flc_bits = get_bits(gb, 2) + 1; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
