[FFmpeg-devel] [PATCH] avcodec/ffv1enc: refine end condition (PR #21286)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21286 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21286
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21286.patch

In the case where the last sorted value was -1u and we where on the first
pass of run1 we failed to fill the last few values of bitmap

No real world testcase is known

Fixes: use of uninitialized memory
Fixes: 460333808/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-6370167888347136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From 10f09dbb9db10debacfc6e03ce455d3668a9968a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 23 Dec 2025 18:26:41 +0100
Subject: [PATCH] avcodec/ffv1enc: refine end condition

In the case where the last sorted value was -1u and we where on the first
pass of run1 we failed to fill the last few values of bitmap

No real world testcase is known

Fixes: use of uninitialized memory
Fixes: 460333808/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFV1_fuzzer-6370167888347136

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/ffv1enc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/ffv1enc.c b/libavcodec/ffv1enc.c
index 5daa3aa0cd..623bd2a3ea 100644
--- a/libavcodec/ffv1enc.c
+++ b/libavcodec/ffv1enc.c
@@ -435,7 +435,7 @@ static void set_micro_version(FFV1Context *f)
         if (f->version == 3) {
             f->micro_version = 4;
         } else if (f->version == 4) {
-            f->micro_version = 8;
+            f->micro_version = 9;
         } else
             av_assert0(0);
 
@@ -1312,7 +1312,7 @@ static int encode_float32_remap_segment(FFV1SliceContext *sc,
         int current_mul = current_mul_index < 0 ? 1 : FFABS(mul[current_mul_index]);
         int64_t val;
         if (i == pixel_num) {
-            if (last_val == 0xFFFFFFFF) {
+            if (last_val == 0xFFFFFFFF && (!run || run1final)) {
                 break;
             } else {
                 val = last_val + ((1LL<<32) - last_val + current_mul - 1) / current_mul * current_mul;
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org