PR #25856 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25856 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25856.patch
>From 97e8225697618cf3397b723a60d6dc75001bd49c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 8 Nov 2026 02:05:58 +0100 Subject: [PATCH 1/2] avcodec/cuviddec: clear the callback error once it has been reported Fixes: infinite loop Fixes: h7TSdP1ov8N5 Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25231 Infinite loop Replicated through UnModified FFmpeg with gdb --- libavcodec/cuviddec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavcodec/cuviddec.c b/libavcodec/cuviddec.c index c47240d6e15..bc0731652b0 100644 --- a/libavcodec/cuviddec.c +++ b/libavcodec/cuviddec.c @@ -889,6 +889,7 @@ static int cuvid_decode_packet(AVCodecContext *avctx, const AVPacket *avpkt) if (ctx->internal_error) { av_log(avctx, AV_LOG_ERROR, "cuvid decode callback error\n"); ret = ctx->internal_error; + ctx->internal_error = 0; goto error; } -- 2.54.0 >From 41e9bb7b912633b4031e25e3e76c9aae27cb89a1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 8 Nov 2026 02:05:58 +0100 Subject: [PATCH 2/2] avcodec/encode: reject hardware frames smaller than the encoder Fixes: out of array read on the GPU Fixes: sXJ4jXv1fs6M Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25682 Out of array read on the GPU Replicated through UnModified FFmpeg with the CUDA error reporting and the decoded output Out of array read on the GPU Replicated through API with the CUDA error reporting and the decoded output --- libavcodec/encode.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/libavcodec/encode.c b/libavcodec/encode.c index c84cd878267..f0e68915a52 100644 --- a/libavcodec/encode.c +++ b/libavcodec/encode.c @@ -22,6 +22,7 @@ #include "libavutil/channel_layout.h" #include "libavutil/emms.h" #include "libavutil/frame.h" +#include "libavutil/hwcontext.h" #include "libavutil/internal.h" #include "libavutil/intreadwrite.h" #include "libavutil/mem.h" @@ -522,9 +523,17 @@ static int encode_send_frame_internal(AVCodecContext *avctx, const AVFrame *src) } else if (!(avctx->codec->capabilities & AV_CODEC_CAP_PARAM_CHANGE)) { const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(src->format); - if (!(desc && desc->flags & AV_PIX_FMT_FLAG_HWACCEL) && - (src->format != avctx->pix_fmt || - src->width != avctx->width || src->height != avctx->height)) { + if (desc && desc->flags & AV_PIX_FMT_FLAG_HWACCEL) { + if (src->hw_frames_ctx) { + const AVHWFramesContext *frames_ctx = (AVHWFramesContext *)src->hw_frames_ctx->data; + + if (frames_ctx->width < avctx->width || frames_ctx->height < avctx->height) { + av_log(avctx, AV_LOG_ERROR, "Hardware frames are smaller than the encoder\n"); + return AVERROR(EINVAL); + } + } + } else if (src->format != avctx->pix_fmt || + src->width != avctx->width || src->height != avctx->height) { av_log(avctx, AV_LOG_ERROR, "Frame size or pixel format does not match the encoder\n"); return AVERROR(EINVAL); } -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
