This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit a41f5431137029215bc444af9cf5f16ce33e0400 Author: Michael Niedermayer <[email protected]> AuthorDate: Tue Jul 7 02:46:20 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Tue Jul 7 13:06:58 2026 +0000 avcodec/vvc/dec: fix pixel buffer tab leak on chroma format change Fixes: memleak Fixes: 518575619/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VVC_fuzzer-5161396783611904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg --- libavcodec/vvc/dec.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/libavcodec/vvc/dec.c b/libavcodec/vvc/dec.c index ebe8e96272..926288e07b 100644 --- a/libavcodec/vvc/dec.c +++ b/libavcodec/vvc/dec.c @@ -86,6 +86,8 @@ static int tl_create(TabList *l) for (int i = 0; i < l->nb_tabs; i++) { Tab *t = l->tabs + i; + if (!t->size) + continue; *t->tab = l->zero ? av_mallocz(t->size) : av_malloc(t->size); if (!*t->tab) return AVERROR(ENOMEM); @@ -245,9 +247,12 @@ static void pixel_buffer_nz_tl_init(TabList *l, VVCFrameContext *fc) tl_init(l, 0, changed); - for (int c_idx = 0; c_idx < c_end; c_idx++) { - const int w = width >> (sps ? sps->hshift[c_idx] : 0); - const int h = height >> (sps ? sps->vshift[c_idx] : 0); + /* Add size 0 tabs for the components beyond c_end, so tl_free() frees + * tabs allocated under a previous, larger chroma format. */ + for (int c_idx = 0; c_idx < VVC_MAX_SAMPLE_ARRAYS; c_idx++) { + const int active = c_idx < c_end; + const int w = active ? width >> (sps ? sps->hshift[c_idx] : 0) : 0; + const int h = active ? height >> (sps ? sps->vshift[c_idx] : 0) : 0; const int border_pixels = c_idx ? ALF_BORDER_CHROMA : ALF_BORDER_LUMA; TL_ADD(sao_pixel_buffer_h[c_idx], (w * 2 * ctu_height) << ps); TL_ADD(sao_pixel_buffer_v[c_idx], (h * 2 * ctu_width) << ps); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
