This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 3b85fbe89025ea696988488358dfde41a09c53c5 Author: Cloud-LHY <[email protected]> AuthorDate: Fri Jul 10 04:07:04 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue Jul 21 22:59:58 2026 +0200 avcodec/tdsc: unref the reference frame before reallocating on size change Fixes: out of array access Fixes: tdsc_poc/ffmpeg-tdsc-linesize-report/poc.avi / gen_poc.py Fixes: tdsc_resize_jpeg_oob.avi / tdsc-resize-stale-linesize-jpeg-oob-generate-poc.py Fixes: p9xG4xGf9P7H Fixes: HQL7a1WgTdHZ Found-by: Cloud-LHY / Clouditera Security, Z.ai Security, NSFOCUS Found-by: Adrian Junge (vurlo) (cherry picked from commit fd3ee52fab34d98a95b787d0b5ff45685766200c) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/tdsc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c index ca9dd0f0a6..102b4ae966 100644 --- a/libavcodec/tdsc.c +++ b/libavcodec/tdsc.c @@ -485,11 +485,15 @@ static int tdsc_parse_tdsf(AVCodecContext *avctx, int number_tiles) return ret; init_refframe = 1; } - ctx->refframe->width = ctx->width = w; - ctx->refframe->height = ctx->height = h; + ctx->width = w; + ctx->height = h; /* Allocate the reference frame if not already done or on size change */ if (init_refframe) { + av_frame_unref(ctx->refframe); + ctx->refframe->format = avctx->pix_fmt; + ctx->refframe->width = w; + ctx->refframe->height = h; ret = av_frame_get_buffer(ctx->refframe, 0); if (ret < 0) return ret; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
