Files
FFmpeg/libavcodec
Nicholas Carlini 39e1969303 avcodec/h264_slice: reject slice_num >= 0xFFFF
An H.264 picture with 65536 slices makes slice_num collide with the
slice_table sentinel. slice_table is uint16_t, initialized via
memset(..., -1, ...) so spare entries (one per row, mb_stride =
mb_width + 1) stay 0xFFFF. slice_num is an uncapped ++h->current_slice.
At slice 65535 the collision makes slice_table[spare] == slice_num
pass, defeating the deblock_topleft check in xchg_mb_border and the
top_type zeroing in fill_decode_caches.

With both guards bypassed at mb_x = 0, top_borders[top_idx][-1]
underflows 96 bytes and XCHG writes at -88 below the allocation
(plus -72 and -56 for chroma in the non-444 path).

Fixes: heap-buffer-overflow

Found-by: Nicholas Carlini <nicholas@carlini.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-03-14 16:52:58 +00:00
..
2026-03-10 13:52:18 +01:00
2026-03-10 13:52:19 +01:00
2026-03-03 00:35:35 +01:00
2026-03-10 19:31:00 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00
2026-03-10 13:52:19 +01:00
2026-02-23 23:58:11 +01:00
2026-03-13 16:09:40 +00:00
2026-03-13 02:49:59 +01:00
2026-03-10 13:52:19 +01:00
2026-01-02 18:39:48 +01:00
2026-03-07 19:22:40 -03:00
2026-01-10 22:47:22 +01:00
2026-02-04 12:05:35 +08:00
2026-02-04 12:05:35 +08:00
2026-02-11 20:35:20 +00:00
2026-03-10 13:52:19 +01:00
2026-02-19 22:39:35 +00:00
2026-03-02 19:01:46 +01:00
2026-03-02 19:01:46 +01:00
2026-03-10 13:52:18 +01:00
2026-03-03 02:41:05 +01:00
2026-03-10 13:52:19 +01:00
2026-03-03 02:13:58 +00:00
2026-02-23 15:29:27 +00:00
2026-03-10 13:52:18 +01:00
2026-01-02 18:39:48 +01:00
2026-01-02 18:39:48 +01:00