PR #23846 opened by ffmpeg-devel URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23846 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23846.patch
**Backport:** https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23742 D3D12VA fully trusts the return value of ff_d3d12va_get_suitable_max_bitstream_size(), which just returns av_image_get_buffer_size(frames_ctx->sw_format, avctx->coded_width, avctx->coded_height, 1). No size checking was done. So a file specifically crafted to bust that limit is able to overflow that buffer. At least I wasn't able to find any size checking done anywhere, so this is what this series adds. This was originally found by depthfirst, but only the instance the first commit fixes. When I looked into it more, I found the same issue in all other d3d12va decoders, as well as the other instance inside of the AV1 one. >From 8ec4057ef11b072eff6288ea7df0e2bdd11d7f62 Mon Sep 17 00:00:00 2001 From: Timo Rothenpieler <[email protected]> Date: Thu, 9 Jul 2026 00:50:32 +0200 Subject: [PATCH] avcodec/d3d12va_vp9: check size of frame bitstream against available buffer size (cherry picked from commit a633df56a455ffb75cd97af784cb1f2d2ec2bca9) --- libavcodec/d3d12va_vp9.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/d3d12va_vp9.c b/libavcodec/d3d12va_vp9.c index 6f1f933fdd..f224044279 100644 --- a/libavcodec/d3d12va_vp9.c +++ b/libavcodec/d3d12va_vp9.c @@ -88,12 +88,18 @@ static int d3d12va_vp9_decode_slice(AVCodecContext *avctx, const uint8_t *buffer static int update_input_arguments(AVCodecContext *avctx, D3D12_VIDEO_DECODE_INPUT_STREAM_ARGUMENTS *input_args, ID3D12Resource *buffer) { + D3D12VADecodeContext *ctx = D3D12VA_DECODE_CONTEXT(avctx); const VP9SharedContext *h = avctx->priv_data; VP9DecodePictureContext *ctx_pic = h->frames[CUR_FRAME].hwaccel_picture_private; void *mapped_data; D3D12_VIDEO_DECODE_FRAME_ARGUMENT *args; + if (ctx_pic->slice.SliceBytesInBuffer > ctx->bitstream_size) { + av_log(avctx, AV_LOG_ERROR, "Input frame bitstream size exceeds internal buffer!\n"); + return AVERROR(EINVAL); + } + if (FAILED(ID3D12Resource_Map(buffer, 0, NULL, &mapped_data))) { av_log(avctx, AV_LOG_ERROR, "Failed to map D3D12 Buffer resource!\n"); return AVERROR(EINVAL); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
