This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new fd3ee52fab avcodec/tdsc: unref the reference frame before reallocating
on size change
fd3ee52fab is described below
commit fd3ee52fab34d98a95b787d0b5ff45685766200c
Author: Cloud-LHY <[email protected]>
AuthorDate: Fri Jul 10 04:07:04 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Mon Jul 13 16:13:04 2026 +0000
avcodec/tdsc: unref the reference frame before reallocating on size change
Fixes: out of array access
Fixes: tdsc_poc/ffmpeg-tdsc-linesize-report/poc.avi / gen_poc.py
Fixes: tdsc_resize_jpeg_oob.avi /
tdsc-resize-stale-linesize-jpeg-oob-generate-poc.py
Fixes: p9xG4xGf9P7H
Fixes: HQL7a1WgTdHZ
Found-by: Cloud-LHY / Clouditera Security, Z.ai Security, NSFOCUS
Found-by: Adrian Junge (vurlo)
---
libavcodec/tdsc.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c
index ca9dd0f0a6..102b4ae966 100644
--- a/libavcodec/tdsc.c
+++ b/libavcodec/tdsc.c
@@ -485,11 +485,15 @@ static int tdsc_parse_tdsf(AVCodecContext *avctx, int
number_tiles)
return ret;
init_refframe = 1;
}
- ctx->refframe->width = ctx->width = w;
- ctx->refframe->height = ctx->height = h;
+ ctx->width = w;
+ ctx->height = h;
/* Allocate the reference frame if not already done or on size change */
if (init_refframe) {
+ av_frame_unref(ctx->refframe);
+ ctx->refframe->format = avctx->pix_fmt;
+ ctx->refframe->width = w;
+ ctx->refframe->height = h;
ret = av_frame_get_buffer(ctx->refframe, 0);
if (ret < 0)
return ret;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
