This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new c5150ad48b avcodec/hevc/ps: avoid signed overflow reading act qp
offsets
c5150ad48b is described below
commit c5150ad48b2c6e14b01a4f73b5922f00ca200869
Author: Michael Niedermayer <[email protected]>
AuthorDate: Wed Jul 1 06:09:34 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Tue Jul 7 17:30:51 2026 +0000
avcodec/hevc/ps: avoid signed overflow reading act qp offsets
Fixes:
523734452/clusterfuzz-testcase-minimized-ffmpeg_dem_HEVC_fuzzer-5246801451220992
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/hevc/ps.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/hevc/ps.c b/libavcodec/hevc/ps.c
index 8884192375..c303ae4c13 100644
--- a/libavcodec/hevc/ps.c
+++ b/libavcodec/hevc/ps.c
@@ -2020,9 +2020,9 @@ static int pps_scc_extension(GetBitContext *gb,
AVCodecContext *avctx,
pps->pps_curr_pic_ref_enabled_flag = get_bits1(gb);
if (pps->residual_adaptive_colour_transform_enabled_flag = get_bits1(gb)) {
pps->pps_slice_act_qp_offsets_present_flag = get_bits1(gb);
- pps->pps_act_y_qp_offset = get_se_golomb(gb) - 5;
- pps->pps_act_cb_qp_offset = get_se_golomb(gb) - 5;
- pps->pps_act_cr_qp_offset = get_se_golomb(gb) - 3;
+ pps->pps_act_y_qp_offset = get_se_golomb(gb) - 5U;
+ pps->pps_act_cb_qp_offset = get_se_golomb(gb) - 5U;
+ pps->pps_act_cr_qp_offset = get_se_golomb(gb) - 3U;
#define CHECK_QP_OFFSET(name) (pps->pps_act_ ## name ## _qp_offset <= -12 || \
pps->pps_act_ ## name ## _qp_offset >= 12)
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
