Zhao Zhili
6f0f9a67d3
avcodec/hevc: limit missing-ref fill to coded planes
...
generate_missing_ref walked frame->f->data[] until a NULL slot, which
on alpha-video frames extended to data[3] and read
sps->hshift[3]/vshift[3] out of bounds.
The alpha plane is produced by the alpha layer via
replace_alpha_plane; the base decoder path never reads or writes it.
Bound the fill loop by the SPS coded plane count. This both removes
the out-of-bounds shift access and avoids an unnecessary full-frame
memset of the alpha plane.
Fixes: out of array read
Fixes: 500770604/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6157374833623040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
(cherry picked from commit 3b939ced79 )
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2026-06-18 20:30:51 +02:00
..
2026-05-04 15:57:24 +02:00
2026-03-06 01:40:28 +01:00
2025-12-07 15:54:59 +00:00
2026-06-18 20:30:51 +02:00
2025-12-07 15:54:59 +00:00
2025-09-26 12:49:26 +00:00
2025-09-08 02:13:23 +02:00
2026-06-10 15:12:23 +01:00
2025-12-07 15:54:59 +00:00
2025-09-08 02:13:26 +02:00
2026-05-04 15:57:06 +02:00
2026-05-04 15:57:33 +02:00
2026-05-04 15:57:19 +02:00
2026-05-05 03:42:05 +02:00
2026-05-04 15:57:08 +02:00
2026-06-10 15:12:24 +01:00
2026-05-04 15:57:10 +02:00
2026-05-04 15:57:10 +02:00
2026-05-04 15:57:10 +02:00
2025-12-07 15:54:59 +00:00
2025-09-08 02:13:29 +02:00
2026-05-04 15:57:06 +02:00
2026-01-12 20:53:17 -03:00
2026-05-04 15:57:27 +02:00
2026-05-04 15:57:33 +02:00
2025-12-07 15:54:59 +00:00
2026-05-04 15:57:22 +02:00
2026-05-04 15:57:05 +02:00
2026-05-04 15:57:24 +02:00
2026-05-04 15:57:21 +02:00
2025-12-07 15:54:59 +00:00
2025-09-08 02:13:25 +02:00
2025-12-07 15:54:59 +00:00
2025-09-08 02:13:19 +02:00
2026-05-04 15:57:11 +02:00
2025-11-19 12:45:53 +01:00
2025-11-19 12:45:53 +01:00
2025-09-08 02:13:28 +02:00
2026-05-04 15:57:13 +02:00
2026-05-04 15:57:29 +02:00
2025-12-07 15:54:59 +00:00
2026-05-04 15:57:13 +02:00
2026-05-04 15:57:29 +02:00
2026-05-04 15:57:29 +02:00
2026-05-04 15:57:22 +02:00
2026-06-18 20:30:51 +02:00
2025-09-08 02:13:27 +02:00
2025-12-07 15:54:59 +00:00
2026-05-04 15:57:12 +02:00
2026-05-04 15:57:12 +02:00
2026-05-04 15:57:04 +02:00
2026-05-04 15:57:11 +02:00
2026-01-12 20:53:40 -03:00
2026-05-04 15:57:18 +02:00
2025-09-14 00:31:17 +02:00
2026-02-02 17:20:52 +01:00
2025-09-08 02:13:29 +02:00
2026-05-04 15:57:05 +02:00
2025-09-08 02:13:33 +02:00
2026-05-04 15:57:18 +02:00
2026-01-12 20:53:17 -03:00
2026-05-04 15:57:11 +02:00
2025-11-19 12:45:55 +01:00
2026-05-04 15:57:02 +02:00
2025-10-28 13:41:41 -03:00
2025-09-08 02:13:22 +02:00
2025-12-07 15:54:59 +00:00
2025-12-07 15:54:59 +00:00
2026-05-04 15:57:14 +02:00
2025-12-07 15:54:59 +00:00
2025-12-07 15:54:59 +00:00
2026-05-04 15:57:28 +02:00
2026-05-04 15:57:02 +02:00
2025-11-19 12:45:55 +01:00
2026-05-04 15:57:29 +02:00
2026-05-04 15:57:15 +02:00
2025-09-16 15:56:16 -03:00
2026-05-04 15:57:04 +02:00
2026-05-04 15:57:31 +02:00
2026-05-04 15:57:31 +02:00
2025-09-08 02:13:32 +02:00
2025-09-08 02:13:27 +02:00
2025-12-07 15:54:59 +00:00
2026-05-04 15:57:15 +02:00
2026-05-04 15:57:25 +02:00
2026-02-09 12:41:59 +01:00
2026-05-04 15:57:28 +02:00
2026-05-04 15:57:12 +02:00
2026-05-04 15:57:17 +02:00
2025-11-19 12:45:55 +01:00
2026-04-15 23:13:35 +08:00
2026-04-15 23:13:35 +08:00
2025-11-19 12:45:53 +01:00
2026-05-04 15:57:14 +02:00
2026-05-04 15:57:25 +02:00
2026-05-04 15:57:28 +02:00
2026-05-04 15:57:21 +02:00
2026-05-04 15:57:31 +02:00