PR #24618 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24618 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24618.patch
The temporary block passed to decode_block() has a stride of 8, so row yy begins at tmp + 8*yy. Copying from tmp + yy filled the bottom rows of the last chroma block row with the first row shifted by yy pixels. Found during triage/review of the security report No6ZPCFThFAM >From ea7c42a6ca26e95ad6002a1030db5f0a46e0c405 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 21 Sep 2026 23:16:45 +0200 Subject: [PATCH] avcodec/leaddec: copy the clipped chroma rows from the start of each row The temporary block passed to decode_block() has a stride of 8, so row yy begins at tmp + 8*yy. Copying from tmp + yy filled the bottom rows of the last chroma block row with the first row shifted by yy pixels. Found during triage/review of the security report No6ZPCFThFAM --- libavcodec/leaddec.c | 2 +- tests/ref/fate/lead-yuv420p-zero | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/leaddec.c b/libavcodec/leaddec.c index fe795bd7c2..e0fa07fd1d 100644 --- a/libavcodec/leaddec.c +++ b/libavcodec/leaddec.c @@ -240,7 +240,7 @@ static int lead_decode_frame(AVCodecContext *avctx, AVFrame * frame, ret = decode_block(s, &gb, dc_vlc, dc_bits, ac_vlc, ac_bits, dc_pred + plane, dequant[!(b < 4)], tmp, 8); for (int yy = 0; yy < 8 && y + yy < avctx->height / 2; yy++) - memcpy(frame->data[plane] + (y+yy)*frame->linesize[plane] + x, tmp + yy, 8); + memcpy(frame->data[plane] + (y+yy)*frame->linesize[plane] + x, tmp + 8*yy, 8); } else { ret = decode_block(s, &gb, dc_vlc, dc_bits, ac_vlc, ac_bits, dc_pred + plane, dequant[!(b < 4)], diff --git a/tests/ref/fate/lead-yuv420p-zero b/tests/ref/fate/lead-yuv420p-zero index 8903fb46eb..3191ca3574 100644 --- a/tests/ref/fate/lead-yuv420p-zero +++ b/tests/ref/fate/lead-yuv420p-zero @@ -3,4 +3,4 @@ #codec_id 0: rawvideo #dimensions 0: 352x288 #sar 0: 0/1 -0, 0, 0, 1, 152064, 0xf7c5eb37 +0, 0, 0, 1, 152064, 0xdfddebe5 -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
