This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 1307db3d3c95223b1d2164844e0542cddbb2a401 Author: Timo Rothenpieler <[email protected]> AuthorDate: Thu Jul 9 00:50:20 2026 +0200 Commit: Timo Rothenpieler <[email protected]> CommitDate: Mon Jul 13 21:13:25 2026 +0200 avcodec/d3d12va_vc1: check size of frame bitstream against available buffer size --- libavcodec/d3d12va_vc1.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libavcodec/d3d12va_vc1.c b/libavcodec/d3d12va_vc1.c index e64a8e0630..2386d2a29b 100644 --- a/libavcodec/d3d12va_vc1.c +++ b/libavcodec/d3d12va_vc1.c @@ -94,6 +94,7 @@ static int d3d12va_vc1_decode_slice(AVCodecContext *avctx, const uint8_t *buffer static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPUT_STREAM_ARGUMENTS *input_args, ID3D12Resource *buffer) { + D3D12VADecodeContext *ctx = D3D12VA_DECODE_CONTEXT(avctx); const VC1Context *v = avctx->priv_data; const MpegEncContext *s = &v->s; D3D12DecodePictureContext *ctx_pic = s->cur_pic.ptr->hwaccel_picture_private; @@ -101,6 +102,7 @@ static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPU const unsigned mb_count = s->mb_width * (s->mb_height >> v->field_mode); uint8_t *mapped_data, *mapped_ptr; + UINT bitstream_size = ctx->bitstream_size; static const uint8_t start_code[] = { 0, 0, 1, 0x0d }; @@ -115,6 +117,12 @@ static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPU unsigned position = slice->dwSliceDataLocation; unsigned size = slice->dwSliceBitsInBuffer / 8; + if ((uint64_t)size + ((avctx->codec_id == AV_CODEC_ID_VC1) ? sizeof(start_code) : 0) > bitstream_size) { + av_log(avctx, AV_LOG_ERROR, "Input frame bitstream size exceeds internal buffer!\n"); + ID3D12Resource_Unmap(buffer, 0, NULL); + return AVERROR(EINVAL); + } + slice->dwSliceDataLocation = mapped_ptr - mapped_data; if (i < ctx_pic->slice_count - 1) slice->wNumberMBsInSlice = slice[1].wNumberMBsInSlice - slice[0].wNumberMBsInSlice; @@ -129,11 +137,13 @@ static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPU mapped_ptr[3] = 0x0b; mapped_ptr += sizeof(start_code); + bitstream_size -= sizeof(start_code); slice->dwSliceBitsInBuffer += sizeof(start_code) * 8; } memcpy(mapped_ptr, &ctx_pic->bitstream[position], size); mapped_ptr += size; + bitstream_size -= size; } ID3D12Resource_Unmap(buffer, 0, NULL); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
