Files
ffmpeg/libavcodec
Zhao Zhili 6f0f9a67d3 avcodec/hevc: limit missing-ref fill to coded planes
generate_missing_ref walked frame->f->data[] until a NULL slot, which
on alpha-video frames extended to data[3] and read
sps->hshift[3]/vshift[3] out of bounds.

The alpha plane is produced by the alpha layer via
replace_alpha_plane; the base decoder path never reads or writes it.
Bound the fill loop by the SPS coded plane count. This both removes
the out-of-bounds shift access and avoids an unnecessary full-frame
memset of the alpha plane.

Fixes: out of array read
Fixes: 500770604/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6157374833623040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 3b939ced79)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-18 20:30:51 +02:00
..
2025-12-07 15:54:59 +00:00
2025-12-07 15:54:59 +00:00
2025-12-07 15:54:59 +00:00
2026-05-04 15:57:06 +02:00
2026-05-04 15:57:08 +02:00
2025-12-07 15:54:59 +00:00
2026-05-04 15:57:33 +02:00
2025-12-07 15:54:59 +00:00
2025-12-07 15:54:59 +00:00
2025-09-08 02:13:25 +02:00
2025-12-07 15:54:59 +00:00
2025-09-08 02:13:19 +02:00
2025-11-19 12:45:53 +01:00
2025-09-08 02:13:28 +02:00
2025-12-07 15:54:59 +00:00
2025-12-07 15:54:59 +00:00
2026-05-04 15:57:12 +02:00
2026-05-04 15:57:18 +02:00
2025-09-08 02:13:22 +02:00
2025-12-07 15:54:59 +00:00
2026-05-04 15:57:28 +02:00
2025-11-19 12:45:55 +01:00
2025-09-08 02:13:32 +02:00
2025-09-08 02:13:27 +02:00
2025-12-07 15:54:59 +00:00
2026-05-04 15:57:14 +02:00
2026-05-04 15:57:21 +02:00