This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new e2bc6d88cd avcodec/cbs_av1: pad the ITU-T T.35 payload buffer
e2bc6d88cd is described below
commit e2bc6d88cd68184288c16570e04881c3a426a05a
Author: Kenan Alghythee <[email protected]>
AuthorDate: Wed Jul 22 19:20:46 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Tue Jul 28 18:04:35 2026 +0000
avcodec/cbs_av1: pad the ITU-T T.35 payload buffer
Fixes: out of array access
Fixes: SUcVEyk7r3Gc
Found-by: Kenan Alghythee <[email protected]>
---
libavcodec/cbs_av1_syntax_template.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavcodec/cbs_av1_syntax_template.c
b/libavcodec/cbs_av1_syntax_template.c
index f3d84f3c05..e6fd4ff678 100644
--- a/libavcodec/cbs_av1_syntax_template.c
+++ b/libavcodec/cbs_av1_syntax_template.c
@@ -2011,10 +2011,12 @@ static int
FUNC(metadata_itut_t35)(CodedBitstreamContext *ctx, RWContext *rw,
// be arbitrarily many trailing zeroes so we need to read through twice.
current->payload_size = cbs_av1_get_payload_bytes_left(rw);
- current->payload_ref = av_buffer_alloc(current->payload_size);
+ current->payload_ref = av_buffer_alloc(current->payload_size +
+ AV_INPUT_BUFFER_PADDING_SIZE);
if (!current->payload_ref)
return AVERROR(ENOMEM);
current->payload = current->payload_ref->data;
+ memset(current->payload + current->payload_size, 0,
AV_INPUT_BUFFER_PADDING_SIZE);
#endif
for (i = 0; i < current->payload_size; i++)
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
