PR #24594 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24594 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24594.patch
Fixes: negative-size-param memcpy Fixes: cpQNfGKYA4J3 Regression since: aea4d4b423 Found-by: Joshua Rogers <[email protected]> >From b206847862d53c127f7cb3a7a540cc9073685bb2 Mon Sep 17 00:00:00 2001 From: Joshua Rogers <[email protected]> Date: Mon, 31 Aug 2026 15:32:15 +0200 Subject: [PATCH] avutil/hwcontext_vulkan: reject negative linesizes before software frame transfer Fixes: negative-size-param memcpy Fixes: cpQNfGKYA4J3 Regression since: aea4d4b423 Found-by: Joshua Rogers <[email protected]> --- libavutil/hwcontext_vulkan.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavutil/hwcontext_vulkan.c b/libavutil/hwcontext_vulkan.c index 2859ee17c3..f32dde541a 100644 --- a/libavutil/hwcontext_vulkan.c +++ b/libavutil/hwcontext_vulkan.c @@ -4969,6 +4969,11 @@ static int vulkan_transfer_frame(AVHWFramesContext *hwfc, if (swf->width > hwfc->width || swf->height > hwfc->height) return AVERROR(EINVAL); + for (int i = 0; i < av_pix_fmt_count_planes(swf->format); i++) { + if (swf->linesize[i] < 0) + return AVERROR(EINVAL); + } + int host_copy = hwctx->usage & VK_IMAGE_USAGE_HOST_TRANSFER_BIT_EXT; /* Host layout transitions may only originate from a host-copyable layout */ -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
