This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new b5c7c7d273 avcodec/cbs_h266_syntax_template: tighten
sh_num_tiles_in_slice_minus1 upper bound
b5c7c7d273 is described below
commit b5c7c7d273f5027597d4af2410b6a3314ee4561b
Author: Michael Niedermayer <[email protected]>
AuthorDate: Wed May 6 04:15:25 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Thu May 7 13:08:34 2026 +0000
avcodec/cbs_h266_syntax_template: tighten sh_num_tiles_in_slice_minus1
upper bound
Fixes: out of array access
Found-by: Vishal Panchani
Fix suggested by: Vishal Panchani
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/cbs_h266_syntax_template.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/cbs_h266_syntax_template.c
b/libavcodec/cbs_h266_syntax_template.c
index fc79ba46c7..b5aa235334 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -3145,7 +3145,7 @@ static int FUNC(slice_header) (CodedBitstreamContext
*ctx, RWContext *rw,
if (!pps->pps_rect_slice_flag &&
pps->num_tiles_in_pic - current->sh_slice_address > 1)
- ue(sh_num_tiles_in_slice_minus1, 0, pps->num_tiles_in_pic - 1);
+ ue(sh_num_tiles_in_slice_minus1, 0, pps->num_tiles_in_pic - 1 -
current->sh_slice_address);
else
infer(sh_num_tiles_in_slice_minus1, 0);
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
