From ebafaee10ab45fce1964bd09efcd848e2da5b401 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 19 Sep 2026 22:16:35 +0200 Subject: [PATCH] avcodec/h264dec: do not add 0 to the NULL plane pointers when filling a missing field Not a vulnerability Fixes: irADzptPLJF2 Found-by: Qiang Li (cherry picked from commit 4a511dc8eba349b43817e49661b28d521c6b604a) Signed-off-by: iceray --- libavcodec/h264dec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/h264dec.c b/libavcodec/h264dec.c index ca65df2b84..1f055345c2 100644 --- a/libavcodec/h264dec.c +++ b/libavcodec/h264dec.c @@ -948,8 +948,8 @@ static int finalize_frame(H264Context *h, AVFrame *dst, H264Picture *out, int *g av_log(h->avctx, AV_LOG_DEBUG, "Duplicating field %d to fill missing\n", field); for (p = 0; p<4; p++) { - dst_data[p] = f->data[p] + (field^1)*f->linesize[p]; - src_data[p] = f->data[p] + field *f->linesize[p]; + dst_data[p] = FF_PTR_ADD(f->data[p], (field^1)*f->linesize[p]); + src_data[p] = FF_PTR_ADD(f->data[p], field *f->linesize[p]); linesizes[p] = 2*f->linesize[p]; }