PR #25087 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25087 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25087.patch
Fixes: heap-use-after-free Fixes: R2BPZKw47umx Fixes: RAP_B_Bossen_1.bit Regression since: 767f53533a Heap use after free Replicated through UnModified FFmpeg with ASAN Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765 Signed-off-by: Michael Niedermayer <[email protected]> >From 424b4f71341af5081c80fb7022fa09e3c4390091 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 14 Oct 2026 21:25:49 +0200 Subject: [PATCH] avcodec/nvdec: take the output sw_format from the decoder's frames context Fixes: heap-use-after-free Fixes: R2BPZKw47umx Fixes: RAP_B_Bossen_1.bit Regression since: 767f53533a Heap use after free Replicated through UnModified FFmpeg with ASAN Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765 Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/nvdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/nvdec.c b/libavcodec/nvdec.c index f0ae2130c2..390331df3b 100644 --- a/libavcodec/nvdec.c +++ b/libavcodec/nvdec.c @@ -800,7 +800,7 @@ static int nvdec_retrieve_data(void *logctx, AVFrame *frame) NVDECFrame *cf = (NVDECFrame*)fdd->hwaccel_priv; NVDECDecoder *decoder = cf->decoder; - AVHWFramesContext *hwctx = (AVHWFramesContext *)frame->hw_frames_ctx->data; + AVHWFramesContext *hwctx = (AVHWFramesContext *)decoder->real_hw_frames_ref->data; CUVIDPROCPARAMS vpp = { 0 }; NVDECFrame *unmap_data = NULL; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
