This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 8553e6ef5785ecc15733da84b49dea85d7b59dc1 Author: Kenan Alghythee <[email protected]> AuthorDate: Wed Jul 22 19:20:46 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:29 2026 +0200 avcodec/cbs_av1: pad the ITU-T T.35 payload buffer Fixes: out of array access Fixes: SUcVEyk7r3Gc Found-by: Kenan Alghythee <[email protected]> (cherry picked from commit e2bc6d88cd68184288c16570e04881c3a426a05a) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/cbs_av1_syntax_template.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/cbs_av1_syntax_template.c b/libavcodec/cbs_av1_syntax_template.c index f3d84f3c05..e6fd4ff678 100644 --- a/libavcodec/cbs_av1_syntax_template.c +++ b/libavcodec/cbs_av1_syntax_template.c @@ -2011,10 +2011,12 @@ static int FUNC(metadata_itut_t35)(CodedBitstreamContext *ctx, RWContext *rw, // be arbitrarily many trailing zeroes so we need to read through twice. current->payload_size = cbs_av1_get_payload_bytes_left(rw); - current->payload_ref = av_buffer_alloc(current->payload_size); + current->payload_ref = av_buffer_alloc(current->payload_size + + AV_INPUT_BUFFER_PADDING_SIZE); if (!current->payload_ref) return AVERROR(ENOMEM); current->payload = current->payload_ref->data; + memset(current->payload + current->payload_size, 0, AV_INPUT_BUFFER_PADDING_SIZE); #endif for (i = 0; i < current->payload_size; i++) _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
