From 01ce3d4d4fea2ed74cafe97775c3cc1bb05aba83 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 19 Sep 2026 22:16:35 +0200 Subject: [PATCH] avcodec/mimic: carry the pinned block grid across frame threads Fixes: heap-buffer-overflow write Fixes: F3EGBYxEoA9T Fixes: ANT-2026-A02CF8FP Found-by: Anthropic using Claude, verified by Ada Logics --- libavcodec/mimic.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/mimic.c b/libavcodec/mimic.c index 08e250961e..e9ed1a9b7c 100644 --- a/libavcodec/mimic.c +++ b/libavcodec/mimic.c @@ -152,6 +152,12 @@ static int mimic_decode_update_thread_context(AVCodecContext *avctx, const AVCod dst->cur_index = src->next_cur_index; dst->prev_index = src->next_prev_index; + if (src->avctx) { + dst->avctx = avctx; + memcpy(dst->num_vblocks, src->num_vblocks, sizeof(dst->num_vblocks)); + memcpy(dst->num_hblocks, src->num_hblocks, sizeof(dst->num_hblocks)); + } + for (int i = 0; i < FF_ARRAY_ELEMS(dst->frames); i++) { ff_progress_frame_unref(&dst->frames[i]); if (i != src->next_cur_index && src->frames[i].f)