PR #24771 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24771 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24771.patch
Fixes: heap out of array read in rav1e with a truncated pass-2 log Fixes: c2jCdj0i7WcP Found-by: Hongduo Zhao Replicated through UnModified FFmpeg >From 691a53ffc16fb6a1309b9acf0e04db9438338bd7 Mon Sep 17 00:00:00 2001 From: Hongduo Zhao <[email protected]> Date: Tue, 29 Sep 2026 01:57:32 +0200 Subject: [PATCH] avcodec/librav1e: pass the remaining stats size to rav1e_twopass_in() Fixes: heap out of array read in rav1e with a truncated pass-2 log Fixes: c2jCdj0i7WcP Found-by: Hongduo Zhao Replicated through UnModified FFmpeg --- libavcodec/librav1e.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/librav1e.c b/libavcodec/librav1e.c index 0db80830d8..785e9e91ea 100644 --- a/libavcodec/librav1e.c +++ b/libavcodec/librav1e.c @@ -161,7 +161,8 @@ static int set_stats(AVCodecContext *avctx) int ret = 1; while (ret > 0 && ctx->pass_size - ctx->pass_pos > 0) { - ret = rav1e_twopass_in(ctx->ctx, ctx->pass_data + ctx->pass_pos, ctx->pass_size); + ret = rav1e_twopass_in(ctx->ctx, ctx->pass_data + ctx->pass_pos, + ctx->pass_size - ctx->pass_pos); if (ret < 0) return AVERROR_EXTERNAL; ctx->pass_pos += ret; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
