github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-04-20 21:00:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/av1dec: sync frame header and tile group behavior with CBS

Browse Source 
A new Sequence Header or a Temporal Delimiter OBU invalidate any previous frame
if not yet complete (As is the case of missing Tile Groups).
Similarly, a new Frame Header invalidates any onging Tile Group parsing.

Fixes: out of array access
Fixes: av1dec_tile_desync.mp4
Fixes: av1dec_tile_desync_bypass.mp4

Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer
2026-03-03 18:36:17 -03:00
parent 282cf4425d
commit a1496ced65
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/av1dec.c
View File

@@ -1307,6 +1307,8 @@ static int av1_receive_frame_internal(AVCodecContext *avctx, AVFrame *frame)
av_refstruct_replace(&s->seq_ref, unit->content_ref);
s->raw_seq = &obu->obu.sequence_header;
s->raw_frame_header = NULL;
raw_tile_group = NULL;
ret = set_context_with_sequence(avctx, s->raw_seq);
if (ret < 0) {
@@ -1343,6 +1345,8 @@ static int av1_receive_frame_internal(AVCodecContext *avctx, AVFrame *frame)
av_refstruct_replace(&s->header_ref, unit->content_ref);
raw_tile_group = NULL;
if (unit->type == AV1_OBU_FRAME)
s->raw_frame_header = &obu->obu.frame.header;
else
@@ -1415,8 +1419,11 @@ static int av1_receive_frame_internal(AVCodecContext *avctx, AVFrame *frame)
}
}
break;
case AV1_OBU_TILE_LIST:
case AV1_OBU_TEMPORAL_DELIMITER:
s->raw_frame_header = NULL;
raw_tile_group = NULL;
// fall-through
case AV1_OBU_TILE_LIST:
case AV1_OBU_PADDING:
break;
case AV1_OBU_METADATA: