Nicholas Carlini
39e1969303
avcodec/h264_slice: reject slice_num >= 0xFFFF
...
An H.264 picture with 65536 slices makes slice_num collide with the
slice_table sentinel. slice_table is uint16_t, initialized via
memset(..., -1, ...) so spare entries (one per row, mb_stride =
mb_width + 1) stay 0xFFFF. slice_num is an uncapped ++h->current_slice.
At slice 65535 the collision makes slice_table[spare] == slice_num
pass, defeating the deblock_topleft check in xchg_mb_border and the
top_type zeroing in fill_decode_caches.
With both guards bypassed at mb_x = 0, top_borders[top_idx][-1]
underflows 96 bytes and XCHG writes at -88 below the allocation
(plus -72 and -56 for chroma in the non-444 path).
Fixes: heap-buffer-overflow
Found-by: Nicholas Carlini <nicholas@carlini.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2026-03-14 16:52:58 +00:00
..
2026-03-13 23:03:36 +01:00
2026-03-13 21:43:37 +00:00
2026-01-25 22:53:25 +01:00
2026-03-13 02:03:59 +00:00
2026-02-18 13:57:28 +00:00
2026-01-25 22:53:25 +01:00
2026-01-25 22:53:25 +01:00
2026-02-17 20:17:23 -03:00
2026-01-25 22:53:25 +01:00
2026-02-25 12:08:33 +01:00
2026-03-05 14:02:39 +00:00
2026-02-25 12:08:33 +01:00
2026-03-09 07:28:29 +01:00
2026-02-11 12:07:35 +01:00
2026-02-23 07:57:57 +01:00
2026-02-14 20:14:47 +01:00
2026-01-23 14:40:52 +01:00
2026-03-03 01:10:09 +01:00
2026-02-12 10:34:19 +01:00
2026-02-11 12:07:35 +01:00
2026-03-07 19:21:38 -03:00
2026-03-11 10:23:35 +01:00
2026-03-11 10:23:35 +01:00
2026-03-11 10:23:35 +01:00
2026-03-11 10:23:35 +01:00
2026-03-11 10:23:35 +01:00
2026-03-11 10:23:35 +01:00
2026-02-11 12:07:35 +01:00
2026-02-11 12:07:35 +01:00
2026-03-13 04:39:52 +01:00
2026-02-11 12:07:35 +01:00
2026-02-11 12:07:35 +01:00
2026-02-11 12:07:35 +01:00
2026-02-11 12:07:35 +01:00
2026-03-03 13:52:58 -03:00
2026-03-06 23:18:35 -03:00
2026-02-12 09:59:54 -03:00
2026-03-07 20:14:36 +01:00
2026-02-28 16:14:40 -03:00
2026-02-15 20:09:54 +01:00
2026-02-11 12:07:35 +01:00
2026-01-10 18:56:26 +00:00
2026-03-10 13:52:18 +01:00
2026-02-24 10:32:20 -03:00
2026-02-24 10:32:20 -03:00
2026-02-24 10:32:20 -03:00
2026-03-13 23:21:31 +01:00
2026-02-24 10:32:20 -03:00
2026-02-24 10:32:20 -03:00
2026-02-24 10:32:20 -03:00
2026-02-28 16:12:33 -03:00
2026-02-28 16:12:33 -03:00
2026-03-13 09:18:42 -03:00
2026-02-28 16:12:33 -03:00
2026-02-24 10:32:20 -03:00
2026-02-24 10:32:20 -03:00
2026-02-24 10:32:20 -03:00
2026-03-10 13:52:18 +01:00
2026-02-18 23:45:28 +00:00
2026-02-18 23:45:28 +00:00
2026-02-18 23:45:28 +00:00
2026-02-11 12:07:35 +01:00
2026-03-07 19:22:14 -03:00
2026-03-07 19:21:38 -03:00
2026-02-11 12:07:35 +01:00
2026-02-25 08:47:14 +00:00
2026-03-04 14:25:00 +00:00
2026-02-25 08:47:14 +00:00
2026-02-25 08:47:14 +00:00
2026-02-25 08:47:14 +00:00
2026-02-05 18:12:46 +01:00
2026-02-11 12:07:35 +01:00
2026-03-13 09:18:42 -03:00
2026-02-11 12:07:35 +01:00
2026-01-07 13:14:11 +00:00
2026-01-07 13:14:11 +00:00
2026-02-12 11:06:33 +01:00
2026-02-11 12:07:35 +01:00
2026-02-11 12:07:35 +01:00
2026-03-10 13:52:18 +01:00
2026-02-05 16:29:08 +01:00
2026-03-10 13:52:19 +01:00
2026-03-02 12:01:15 +01:00
2026-02-17 20:17:23 -03:00
2026-03-03 13:07:46 +01:00
2026-03-03 13:07:46 +01:00
2026-02-14 18:52:43 +00:00
2026-03-03 00:35:35 +01:00
2026-02-11 12:07:35 +01:00
2026-02-19 19:42:34 +01:00
2026-02-19 19:42:34 +01:00
2026-02-19 19:42:31 +01:00
2026-03-10 19:31:00 +01:00
2026-02-19 19:42:30 +01:00
2026-02-10 19:44:46 +01:00
2026-02-23 22:59:44 +01:00
2026-03-10 13:52:19 +01:00
2026-02-20 11:59:37 +01:00
2026-03-02 18:41:13 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-03-07 20:14:36 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-01-25 22:53:25 +01:00
2026-01-25 22:53:25 +01:00
2026-01-25 22:53:25 +01:00
2026-03-02 17:51:45 +01:00
2026-03-14 16:52:58 +00:00
2026-03-03 13:07:46 +01:00
2026-01-25 22:53:25 +01:00
2026-01-25 22:53:25 +01:00
2026-02-28 16:12:33 -03:00
2026-02-26 11:40:09 +08:00
2026-02-11 12:07:35 +01:00
2026-02-23 23:28:09 +01:00
2026-03-10 13:52:19 +01:00
2026-03-04 22:31:19 +00:00
2026-03-04 22:31:19 +00:00
2026-03-01 12:04:14 +01:00
2026-03-01 11:58:16 +01:00
2026-03-01 11:58:16 +01:00
2026-02-11 12:07:35 +01:00
2026-02-23 23:58:11 +01:00
2026-02-23 23:50:49 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-03-03 00:35:21 +01:00
2026-03-02 18:12:40 +01:00
2026-02-20 16:32:10 +01:00
2026-02-20 16:32:10 +01:00
2026-02-20 16:32:10 +01:00
2026-03-09 18:39:33 -03:00
2026-03-13 09:18:42 -03:00
2026-02-28 16:12:33 -03:00
2026-03-13 09:18:42 -03:00
2026-03-13 09:18:42 -03:00
2026-03-13 16:09:40 +00:00
2026-03-13 16:09:40 +00:00
2026-03-13 02:49:59 +01:00
2026-02-11 12:07:38 +01:00
2026-02-17 20:17:23 -03:00
2026-02-12 09:59:54 -03:00
2026-01-29 14:08:15 +01:00
2026-02-17 20:17:23 -03:00
2026-02-12 09:59:54 -03:00
2026-02-17 20:17:23 -03:00
2026-02-25 16:43:53 +01:00
2026-02-21 22:43:41 +00:00
2026-02-18 23:38:16 +00:00
2026-02-17 20:17:23 -03:00
2026-02-15 20:28:31 +01:00
2026-02-15 20:28:31 +01:00
2026-01-25 13:09:30 +08:00
2026-02-05 16:29:08 +01:00
2026-02-11 12:07:35 +01:00
2026-03-06 23:25:29 +01:00
2026-03-13 16:09:40 +00:00
2026-02-23 22:54:38 +01:00
2026-02-11 12:07:35 +01:00
2026-01-17 12:02:31 -03:00
2026-02-11 12:07:35 +01:00
2026-02-20 16:32:10 +01:00
2026-03-12 14:47:01 +01:00
2026-03-12 14:47:01 +01:00
2026-03-07 20:14:36 +01:00
2026-01-22 17:44:46 -03:00
2026-01-20 00:38:35 +00:00
2026-03-10 13:52:19 +01:00
2026-02-11 12:07:35 +01:00
2026-02-11 12:07:35 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-03-07 20:14:36 +01:00
2026-03-07 20:14:36 +01:00
2026-03-03 13:07:46 +01:00
2026-03-04 10:40:12 +00:00
2026-03-10 13:52:18 +01:00
2026-03-07 20:14:36 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-02-13 09:21:33 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-02-20 16:32:10 +01:00
2026-02-11 12:07:35 +01:00
2026-01-05 13:30:38 +00:00
2026-02-17 16:36:51 +00:00
2026-03-10 15:08:16 +00:00
2026-01-27 12:58:46 +00:00
2026-01-27 12:58:46 +00:00
2026-01-19 20:47:22 +00:00
2026-02-11 12:07:35 +01:00
2026-03-07 20:14:36 +01:00
2026-02-11 12:07:35 +01:00
2026-03-07 19:21:44 -03:00
2026-03-07 19:22:40 -03:00
2026-02-11 12:07:35 +01:00
2026-02-11 12:07:35 +01:00
2026-01-10 22:47:22 +01:00
2026-01-10 22:47:22 +01:00
2026-02-04 12:05:35 +08:00
2026-02-04 12:05:35 +08:00
2026-01-11 00:47:17 +00:00
2026-03-06 02:33:59 +01:00
2026-02-14 18:53:08 +00:00
2026-03-05 14:02:39 +00:00
2026-03-05 14:02:39 +00:00
2026-03-05 14:02:39 +00:00
2026-03-05 14:02:39 +00:00
2026-02-11 20:35:20 +00:00
2026-03-13 09:18:42 -03:00
2026-02-03 18:17:32 +00:00
2026-02-11 12:07:35 +01:00
2026-02-11 12:07:35 +01:00
2026-02-09 17:36:40 +00:00
2026-02-13 09:21:33 +01:00
2026-03-10 13:52:19 +01:00
2026-03-07 20:14:36 +01:00
2026-03-07 20:14:36 +01:00
2026-03-07 20:14:36 +01:00
2026-02-19 22:39:35 +00:00
2026-01-20 09:47:47 +00:00
2026-02-11 12:07:31 +01:00
2026-02-11 12:07:35 +01:00
2026-03-02 19:01:46 +01:00
2026-02-22 22:05:16 +01:00
2026-03-02 19:01:46 +01:00
2026-03-05 01:23:40 +01:00
2026-01-25 22:53:25 +01:00
2026-02-11 12:07:35 +01:00
2026-02-23 23:26:20 +01:00
2026-02-11 12:07:35 +01:00
2026-03-06 23:08:03 +01:00
2026-03-10 13:52:18 +01:00
2026-01-02 18:39:48 +01:00
2026-01-17 17:56:06 -03:00
2026-03-12 14:47:01 +01:00
2026-03-08 02:31:23 +01:00
2026-02-11 12:07:35 +01:00
2026-03-03 02:41:05 +01:00
2026-03-10 13:52:19 +01:00
2026-03-03 02:13:58 +00:00
2026-01-21 10:42:02 +00:00
2026-01-19 16:37:16 +01:00
2026-02-19 19:42:31 +01:00
2026-03-07 15:14:25 +01:00
2026-02-19 19:42:31 +01:00
2026-02-19 19:42:26 +01:00
2026-02-23 15:29:27 +00:00
2026-03-10 13:52:18 +01:00
2026-02-11 12:07:35 +01:00
2026-02-11 12:07:35 +01:00
2026-01-02 18:39:48 +01:00
2026-03-13 23:22:54 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00