[PR] avcodec/vulkan_hevc: reject too many VPS HRD parameter sets (PR #23665)

PR #23665 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665.patch

Fixes: stack buffer overflow
Fixes: tD7Mj0ST7ND3
Fixes: 82864c21112157951ce91b4430a9018edd02f5ab (vulkan_hevc: use VK_KHR_video_maintenance2 if available)
Found-by: Pavel Kohout (Aisle Research)
Signed-off-by: Michael Niedermayer <[email protected]>



>From ea8087200ce91f3f296a30541a89b19ae4af19a2 Mon Sep 17 00:00:00 2001
From: Pavel Kohout <[email protected]>
Date: Tue, 30 Jun 2026 21:55:49 +0200
Subject: [PATCH] avcodec/vulkan_hevc: reject too many VPS HRD parameter sets

Fixes: stack buffer overflow
Fixes: tD7Mj0ST7ND3
Fixes: 82864c21112157951ce91b4430a9018edd02f5ab (vulkan_hevc: use VK_KHR_video_maintenance2 if available)
Found-by: Pavel Kohout (Aisle Research)
Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavcodec/vulkan_hevc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/vulkan_hevc.c b/libavcodec/vulkan_hevc.c
index 8f0d1f6636..9b9264f1cd 100644
--- a/libavcodec/vulkan_hevc.c
+++ b/libavcodec/vulkan_hevc.c
@@ -875,6 +875,9 @@ static int vk_hevc_end_frame(AVCodecContext *avctx)
                 vksps_p.vcl_hdr, &vksps_p.ptl, &vksps_p.dpbm,
                 &vksps_p.pal, vksps_p.str, &vksps_p.ltr);
 
+        if (sps->vps->vps_num_hrd_parameters > HEVC_MAX_SUB_LAYERS)
+            return AVERROR_INVALIDDATA;
+
         vkvps_p.sls = vkvps_ps;
         set_vps(sps->vps, &vkvps, &vkvps_p.ptl, &vkvps_p.dpbm,
                 vkvps_p.hdr, vkvps_p.sls);
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]