PR #23035 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23035
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23035.patch

Fixes: out of array read
Fixes: 
500770604/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6157374833623040

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>


>From bf05af3e2f6758e64f8c6d3c74b76cab07c2b75e Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Thu, 7 May 2026 01:09:00 +0200
Subject: [PATCH] avcodec/hevc/ps: shift needs 4 entries because alpha

Fixes: out of array read
Fixes: 
500770604/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6157374833623040

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavcodec/hevc/ps.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/hevc/ps.h b/libavcodec/hevc/ps.h
index d620887b8e..b174ff392e 100644
--- a/libavcodec/hevc/ps.h
+++ b/libavcodec/hevc/ps.h
@@ -360,8 +360,8 @@ typedef struct HEVCSPS {
     int min_pu_height;
     int tb_mask;
 
-    int hshift[3];
-    int vshift[3];
+    int hshift[4];
+    int vshift[4];
 
     int qp_bd_offset;
 
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to