[PR] avcodec/cbs_h266: size vps_direct_ref_layer_flag for the full layer range (PR #23902)

PR #23902 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23902
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23902.patch

Fixes: out of array access
Fixes: poc_vvc_vps.266
Fixes: 1z6RugPwxp39
Found-by: TainAn Bill



>From 1fe6954e79b3da6bbb55caf402b3ff71f513d511 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Wed, 22 Jul 2026 06:13:42 +0200
Subject: [PATCH] avcodec/cbs_h266: size vps_direct_ref_layer_flag for the full
 layer range

Fixes: out of array access
Fixes: poc_vvc_vps.266
Fixes: 1z6RugPwxp39
Found-by: TainAn Bill
---
 libavcodec/cbs_h266.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/cbs_h266.h b/libavcodec/cbs_h266.h
index 8d851a0bfb..0dc7d96828 100644
--- a/libavcodec/cbs_h266.h
+++ b/libavcodec/cbs_h266.h
@@ -270,7 +270,7 @@ typedef struct H266RawVPS {
     uint8_t  vps_layer_id[VVC_MAX_LAYERS];
     uint8_t  vps_independent_layer_flag[VVC_MAX_LAYERS];
     uint8_t  vps_max_tid_ref_present_flag[VVC_MAX_LAYERS];
-    uint8_t  vps_direct_ref_layer_flag[VVC_MAX_LAYERS][VVC_MAX_LAYERS - 1];
+    uint8_t  vps_direct_ref_layer_flag[VVC_MAX_LAYERS][VVC_MAX_LAYERS];
     uint8_t  vps_max_tid_il_ref_pics_plus1[VVC_MAX_LAYERS][VVC_MAX_LAYERS - 1];
     uint8_t  vps_each_layer_is_an_ols_flag;
     uint8_t  vps_ols_mode_idc;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]