PR #25067 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067.patch
>From d934ef9db6dcf29197a3f3a2cf6475e6c48ef9ba Mon Sep 17 00:00:00 2001 From: Ayoub Nabil Boubagrat <[email protected]> Date: Tue, 13 Oct 2026 07:11:17 +0200 Subject: [PATCH 1/2] avcodec/lcevctab: add the missing resolution types 22 to 26 The table now matches the one of LCEVCdec. Regression since: 49d75d81f6 Fixes: out of array write Fixes: zKsYtIUkExUC Found-by: Ayoub Nabil Boubagrat <[email protected]> Out of array write Replicated through UnModified FFmpeg with ASAN Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/lcevctab.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/lcevctab.c b/libavcodec/lcevctab.c index f07d599592..666438f1a1 100644 --- a/libavcodec/lcevctab.c +++ b/libavcodec/lcevctab.c @@ -26,7 +26,9 @@ const struct FFLCEVCDim ff_lcevc_resolution_type[63] = { { 854, 480 }, { 856, 480 }, { 960, 540 }, { 960, 640 }, { 1024, 576 }, { 1024, 600 }, { 1024, 768 }, { 1152, 864 }, { 1280, 720 }, { 1280, 800 }, { 1280, 1024 }, { 1360, 768 }, - { 1366, 768 }, { 1920, 1200 }, { 2048, 1080 }, { 2048, 1152 }, + { 1366, 768 }, { 1400, 1050 }, { 1440, 900 }, { 1600, 1200 }, + { 1680, 1050 }, { 1920, 1080 }, { 1920, 1200 }, { 2048, 1080 }, + { 2048, 1152 }, { 2048, 1536 }, { 2160, 1440 }, { 2560, 1440 }, { 2560, 1600 }, { 2560, 2048 }, { 3200, 1800 }, { 3200, 2048 }, { 3200, 2400 }, { 3440, 1440 }, { 3840, 1600 }, { 3840, 2160 }, { 3840, 2400 }, -- 2.52.0 >From 6b6a429ab11ecd1fb6fff78be95c97d8c8813220 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 14 Oct 2026 15:29:44 +0200 Subject: [PATCH 2/2] avcodec/lcevcdec: check the picture LCEVCdec will output against the one allocated Fixes: out of array write Fixes: yOAdvErxaeGg Found-by: Ayoub Nabil Boubagrat <[email protected]> Out of array write Replicated through UnModified FFmpeg with ASAN Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/lcevcdec.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/libavcodec/lcevcdec.c b/libavcodec/lcevcdec.c index a2bda77b4a..e243621b58 100644 --- a/libavcodec/lcevcdec.c +++ b/libavcodec/lcevcdec.c @@ -144,6 +144,7 @@ static int lcevc_send_frame(FFLCEVCFrame *frame_ctx, const AVFrame *in) const AVFrameSideData *sd = av_frame_get_side_data(in, AV_FRAME_DATA_LCEVC); AVFrame *opaque; LCEVC_PictureHandle picture; + LCEVC_PictureDesc desc; LCEVC_ReturnCode res; int ret; @@ -184,6 +185,16 @@ static int lcevc_send_frame(FFLCEVCFrame *frame_ctx, const AVFrame *in) goto end; } + res = LCEVC_PeekDecoderPictureDesc(lcevc->decoder, lcevc->last_pts, &desc); + if (res != LCEVC_Success || + desc.width != frame_ctx->frame->width || + desc.height != frame_ctx->frame->height || + desc.colorFormat != map_format(frame_ctx->frame->format)) { + av_log(lcevc, AV_LOG_ERROR, "Output picture does not match the enhancement data\n"); + ret = AVERROR_INVALIDDATA; + goto end; + } + memset(&picture, 0, sizeof(picture)); ret = alloc_enhanced_frame(frame_ctx, &picture); if (ret < 0) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
