PR #23665 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665.patch
Fixes: stack buffer overflow Fixes: tD7Mj0ST7ND3 Fixes: 82864c21112157951ce91b4430a9018edd02f5ab (vulkan_hevc: use VK_KHR_video_maintenance2 if available) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> >From ea8087200ce91f3f296a30541a89b19ae4af19a2 Mon Sep 17 00:00:00 2001 From: Pavel Kohout <[email protected]> Date: Tue, 30 Jun 2026 21:55:49 +0200 Subject: [PATCH] avcodec/vulkan_hevc: reject too many VPS HRD parameter sets Fixes: stack buffer overflow Fixes: tD7Mj0ST7ND3 Fixes: 82864c21112157951ce91b4430a9018edd02f5ab (vulkan_hevc: use VK_KHR_video_maintenance2 if available) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/vulkan_hevc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/vulkan_hevc.c b/libavcodec/vulkan_hevc.c index 8f0d1f6636..9b9264f1cd 100644 --- a/libavcodec/vulkan_hevc.c +++ b/libavcodec/vulkan_hevc.c @@ -875,6 +875,9 @@ static int vk_hevc_end_frame(AVCodecContext *avctx) vksps_p.vcl_hdr, &vksps_p.ptl, &vksps_p.dpbm, &vksps_p.pal, vksps_p.str, &vksps_p.ltr); + if (sps->vps->vps_num_hrd_parameters > HEVC_MAX_SUB_LAYERS) + return AVERROR_INVALIDDATA; + vkvps_p.sls = vkvps_ps; set_vps(sps->vps, &vkvps, &vkvps_p.ptl, &vkvps_p.dpbm, vkvps_p.hdr, vkvps_p.sls); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
