sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avcodec/d3d12va_av1: check slice bitstream size against available buffer size

Browse Source 
(cherry picked from commit 7309ad9fd7)
This commit is contained in:
Timo Rothenpieler
2026-07-09 00:29:01 +02:00
committed by ffmpeg-devel
parent 60aca6ace7
commit a90fbb6bc9
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/d3d12va_av1.c
View File

@@ -33,6 +33,7 @@
typedef struct D3D12AV1DecodeContext {
D3D12VADecodeContext ctx;
uint8_t *bitstream_buffer;
size_t bitstream_size;
} D3D12AV1DecodeContext;
#define D3D12_AV1_DECODE_CONTEXT(avctx) ((D3D12AV1DecodeContext *)D3D12VA_DECODE_CONTEXT(avctx))
@@ -77,6 +78,7 @@ static int d3d12va_av1_decode_slice(AVCodecContext *avctx,
const AV1DecContext *h = avctx->priv_data;
const AV1RawFrameHeader *frame_header = h->raw_frame_header;
AV1DecodePictureContext *ctx_pic = h->cur_frame.hwaccel_picture_private;
D3D12AV1DecodeContext *av1_ctx = D3D12_AV1_DECODE_CONTEXT(avctx);
int offset = 0;
uint32_t tg_start, tg_end;
@@ -91,7 +93,11 @@ static int d3d12va_av1_decode_slice(AVCodecContext *avctx,
ctx_pic->bitstream = (uint8_t *)buffer;
ctx_pic->bitstream_size = size;
} else {
ctx_pic->bitstream = D3D12_AV1_DECODE_CONTEXT(avctx)->bitstream_buffer;
if (ctx_pic->bitstream_size + (uint64_t)size > av1_ctx->bitstream_size) {
av_log(avctx, AV_LOG_ERROR, "Slice bitstream size exceeds internal buffer!\n");
return AVERROR(EINVAL);
}
ctx_pic->bitstream = av1_ctx->bitstream_buffer;
memcpy(ctx_pic->bitstream + ctx_pic->bitstream_size, buffer, size);
tg_start = h->tg_start;
tg_end = h->tg_end;
@@ -180,7 +186,8 @@ static av_cold int d3d12va_av1_decode_init(AVCodecContext *avctx)
return ret;
if (!av1_ctx->bitstream_buffer) {
av1_ctx->bitstream_buffer = av_malloc(ff_d3d12va_get_suitable_max_bitstream_size(avctx));
av1_ctx->bitstream_size = ff_d3d12va_get_suitable_max_bitstream_size(avctx);
av1_ctx->bitstream_buffer = av_malloc(av1_ctx->bitstream_size);
if (!av1_ctx->bitstream_buffer)
return AVERROR(ENOMEM);
}
@@ -194,6 +201,7 @@ static av_cold int d3d12va_av1_decode_uninit(AVCodecContext *avctx)
if (ctx->bitstream_buffer)
av_freep(&ctx->bitstream_buffer);
ctx->bitstream_size = 0;
return ff_d3d12va_decode_uninit(avctx);
}