James Almer a6ac0c6841 avcodec/hevc/sei: prevent storing a potentially bogus num_ref_displays value in HEVCSEITDRDI ...

Fixes: 439711052/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4956250308935680
Fixes: out of array access

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit d448d6d1a0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

2025-11-19 12:45:52 +01:00

..

cabac.c

lavc/hevcdec: move HEVCContext.tab_ct_depth to HEVCLayerContext

2024-09-06 13:59:29 +02:00

data.c

…

data.h

…

dsp_template.c

avcodec/hevc: ff_hevc_(qpel/epel)_filters are signed type

2024-09-14 16:36:34 +08:00

dsp.c

…

dsp.h

…

filter.c

lavc/hevcdec: make a HEVCFrame hold a reference to its PPS

2024-09-06 13:59:29 +02:00

hevc.h

lavc/hevc_ps: parse VPS extension

2024-09-23 17:11:40 +02:00

hevcdec.c

avcodec/hevc/hevcdec: Clean sao_pixel_buffer_v on allocation

2025-09-08 02:13:14 +02:00

hevcdec.h

lavc/hevcdec: unbreak WPP/progress2 code

2025-02-13 19:45:30 +08:00

Makefile

…

mvs.c

lavc/hevcdec: make a HEVCFrame hold a reference to its PPS

2024-09-06 13:59:29 +02:00

parse.c

lavc/hevcdec/parse: process NALUs with nuh_layer_id>0

2024-09-23 17:11:40 +02:00

parse.h

…

parser.c

lavc/hevc/parser: only split packets on NALUs with nuh_layer_id=0

2024-09-23 17:11:40 +02:00

pred_template.c

…

pred.c

…

pred.h

…

ps_enc.c

…

ps.c

avcodec/hevc/ps: Fix dependant layer id check

2025-06-11 17:29:47 +02:00

ps.h

lavc/hevc/ps: implement SPS parsing for nuh_layer_id>0

2024-09-23 17:11:40 +02:00

refs.c

avcodec/hevc/refs: export Stereo 3D side data

2024-09-23 17:15:02 +02:00

sei.c

avcodec/hevc/sei: prevent storing a potentially bogus num_ref_displays value in HEVCSEITDRDI

2025-11-19 12:45:52 +01:00

sei.h

avcodec/hevc/sei: num_ref_displays can be up to 32

2024-09-24 15:13:19 -03:00