PR #25084 opened by charlymp
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25084
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25084.patch
mvf_run_equal() reads padding the merge candidates left uninitialized.
Fixes: 05c6ee22be ("lavc/hevcdec: skip boundary strength computation for
identical MvFields")
From 4ef750ca559e3986d8d4aedfa16bb4f69b667ce8 Mon Sep 17 00:00:00 2001
From: Charly Morgand-Poyac <[email protected]>
Date: Wed, 14 Oct 2026 23:49:12 +0200
Subject: [PATCH] avcodec/hevc/mvs: zero the merge candidate list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
mvf_run_equal() reads padding the merge candidates left uninitialized.
Fixes: 05c6ee22be ("lavc/hevcdec: skip boundary strength computation for
identical MvFields")
Reported-by: Kacper Michajłow <[email protected]>
Signed-off-by: Charly Morgand-Poyac <[email protected]>
---
libavcodec/hevc/mvs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/hevc/mvs.c b/libavcodec/hevc/mvs.c
index 61c9e4e086..937c7cf753 100644
--- a/libavcodec/hevc/mvs.c
+++ b/libavcodec/hevc/mvs.c
@@ -488,7 +488,7 @@ void ff_hevc_luma_mv_merge_mode(HEVCLocalContext *lc, const
HEVCPPS *pps,
const HEVCContext *const s = lc->parent;
int singleMCLFlag = 0;
int nCS = 1 << log2_cb_size;
- MvField mergecand_list[MRG_MAX_NUM_CANDS];
+ MvField mergecand_list[MRG_MAX_NUM_CANDS] = { 0 };
int nPbW2 = nPbW;
int nPbH2 = nPbH;
--
2.52.0
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
