PR #24570 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24570
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24570.patch

Fixes: heap-buffer-overflow write
Fixes: F3EGBYxEoA9T
Fixes: b06bGhe8qzqk (ANT-2026-A02CF8FP)
Found-by: Anthropic using Claude, verified by Ada Logics



>From f0f13f659dc75bf3c3dc1092b24abadb235d67ef Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Sat, 19 Sep 2026 22:16:35 +0200
Subject: [PATCH] avcodec/mimic: carry the pinned block grid across frame
 threads

Fixes: heap-buffer-overflow write
Fixes: F3EGBYxEoA9T
Fixes: b06bGhe8qzqk (ANT-2026-A02CF8FP)
Found-by: Anthropic using Claude, verified by Ada Logics
---
 libavcodec/mimic.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavcodec/mimic.c b/libavcodec/mimic.c
index 08e250961e..e9ed1a9b7c 100644
--- a/libavcodec/mimic.c
+++ b/libavcodec/mimic.c
@@ -152,6 +152,12 @@ static int 
mimic_decode_update_thread_context(AVCodecContext *avctx, const AVCod
     dst->cur_index  = src->next_cur_index;
     dst->prev_index = src->next_prev_index;
 
+    if (src->avctx) {
+        dst->avctx = avctx;
+        memcpy(dst->num_vblocks, src->num_vblocks, sizeof(dst->num_vblocks));
+        memcpy(dst->num_hblocks, src->num_hblocks, sizeof(dst->num_hblocks));
+    }
+
     for (int i = 0; i < FF_ARRAY_ELEMS(dst->frames); i++) {
         ff_progress_frame_unref(&dst->frames[i]);
         if (i != src->next_cur_index && src->frames[i].f)
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to