PR #25261 opened by Forgejo_Fairy URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25261 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25261.patch
Fixes #24187. A VP5/VP6 header installs new dimensions before `vp56_size_changed()` allocates the dimension-dependent arrays. If either free-on-failure reallocation fails, leaving those dimensions installed allows a following frame to skip resizing and dereference the null array. Clear the dimensions on resize failure so later frames cannot use the incomplete state, and propagate the original error to the caller. Verified with the issue's allocation interposer and `ea-vp6/g36.vp6` under ASan: - three `above_blocks` failure runs returned `ENOMEM` without an invalid access; - three `macroblocks` failure runs returned `ENOMEM` without an invalid access; - `make fate-vp5 fate-vp6 SAMPLES=/opt/fate-suite` passed. >From 4fb1f4e2de7c224610ba0e1aa0cd49d20e2d2427 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 30 Sep 2026 20:04:28 +0000 Subject: [PATCH] avcodec/vp56: Roll back dimensions when resizing fails The VP5/VP6 headers install new dimensions before vp56_size_changed() allocates the arrays for them. If resizing fails, leave the dimensions cleared so following frames cannot use the missing arrays, and preserve the allocation error for the caller. Fixes: 24187 Assisted-by: Fairy --- libavcodec/vp56.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavcodec/vp56.c b/libavcodec/vp56.c index 0d13d7a276c..f740b53915a 100644 --- a/libavcodec/vp56.c +++ b/libavcodec/vp56.c @@ -654,9 +654,11 @@ int ff_vp56_decode_frame(AVCodecContext *avctx, AVFrame *rframe, } if (res == VP56_SIZE_CHANGE) { - if (vp56_size_changed(s)) { + ret = vp56_size_changed(s); + if (ret < 0) { av_frame_unref(p); - return AVERROR_INVALIDDATA; + ff_set_dimensions(avctx, 0, 0); + return ret; } } -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
