This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg.
commit f325ef73b757fb1996da0cab6a6e2733e61e6e6e Author: João Neves <[email protected]> AuthorDate: Wed Apr 8 13:55:37 2026 -0700 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 04:58:57 2026 +0200 avcodec/hdrdec: fix pixel count decrement in RLE decompress loop The w variable counts pixels, not bytes. The non-RLE path correctly uses w-- (one pixel = 4 bytes), but the RLE path uses w -= 4, causing the loop to terminate after roughly 1/4 of the expected pixels. The w -= 4 was introduced in 14e99cb472 which moved the decrement inside the loop to fix an OOB write (clusterfuzz-5423041009549312). The move was correct, but the decrement value should have been 1 to match the non-RLE path. Signed-off-by: João Neves <[email protected]> (cherry picked from commit 2c71a28bf0731f5fdcf9f2366ab98c31270294e4) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/hdrdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c index cffa7570db..1a6935ff75 100644 --- a/libavcodec/hdrdec.c +++ b/libavcodec/hdrdec.c @@ -72,7 +72,7 @@ static int decompress(uint8_t *scanline, int w, GetByteContext *gb, const uint8_ for (int i = run << rshift; i > 0 && w > 0 && scanline >= start + 4; i--) { memcpy(scanline, scanline - 4, 4); scanline += 4; - w -= 4; + w--; } rshift += 8; if (rshift > 16) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
