PR #24511 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24511 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24511.patch
Fixes: out of array write Fixes: feHKdS1bdTcu Found-by: Zheng Yu @ Depthfirst >From 004d1c6ccefc49723b95c273f63d56e347c5d97f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 15 Sep 2026 06:13:53 +0200 Subject: [PATCH] avcodec/cbs_h265: keep the number of decoding units within the number of slice segments Fixes: out of array write Fixes: feHKdS1bdTcu Found-by: Zheng Yu @ Depthfirst --- libavcodec/cbs_h265_syntax_template.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c index c97b7ed361..5ed429546c 100644 --- a/libavcodec/cbs_h265_syntax_template.c +++ b/libavcodec/cbs_h265_syntax_template.c @@ -1994,7 +1994,7 @@ SEI_FUNC(sei_pic_timing, (CodedBitstreamContext *ctx, RWContext *rw, if (hrd->sub_pic_hrd_params_present_flag && hrd->sub_pic_cpb_params_in_pic_timing_sei_flag) { // Each decoding unit must contain at least one slice segment. - ue(num_decoding_units_minus1, 0, HEVC_MAX_SLICE_SEGMENTS); + ue(num_decoding_units_minus1, 0, HEVC_MAX_SLICE_SEGMENTS - 1); flag(du_common_cpb_removal_delay_flag); length = hrd->du_cpb_removal_delay_increment_length_minus1 + 1; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
