This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 4ec127c82678b06658e963291f272881dc878735 Author: Ruk Doe <[email protected]> AuthorDate: Sat Oct 10 15:50:24 2026 +0900 Commit: michaelni <[email protected]> CommitDate: Fri Nov 6 04:39:07 2026 +0000 avcodec/libaribcaption: free only the added rects on ass errors The ass error path freed sub->rects[0] .. [region_count - 1], but ff_ass_add_rect() grows the array one rect at a time and counts the rects it added in sub->num_rects, including one whose dialog string failed to allocate. Entries past num_rects are not initialized, so an allocation failure part way through read them, or past the array. Free up to sub->num_rects instead. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01DdDiDRusmi6eD7qSrKBjHb Reported-by: Forgejo_Fairy Reference: #24992 Found-by: Joshua Rogers <[email protected]> --- libavcodec/libaribcaption.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/libaribcaption.c b/libavcodec/libaribcaption.c index eeda071367..3e22aa5e0a 100644 --- a/libavcodec/libaribcaption.c +++ b/libavcodec/libaribcaption.c @@ -793,7 +793,7 @@ static int aribcaption_trans_ass_subtitle(ARIBCaptionContext *ctx) fail: if (sub->rects) { - for (int i = 0; i < ctx->caption.region_count; i++) { + for (int i = 0; i < sub->num_rects; i++) { if (sub->rects[i]) { av_freep(&sub->rects[i]->ass); av_freep(&sub->rects[i]); -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
