[FFmpeg-devel] [PATCH] libavutil/vulkan: fix flexible array struct allocation

[Lynne]

On 09/10/2024 02:12, Marvin Scholz wrote:
> The flexible array member struct can have padding added by
> the compiler which was not taken into account properly, which
> could lead to a heap buffer overflow.
> ---
>   libavutil/vulkan.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavutil/vulkan.c b/libavutil/vulkan.c
> index cd617496dcb..b9aee7cf902 100644
> --- a/libavutil/vulkan.c
> +++ b/libavutil/vulkan.c
> @@ -644,11 +644,11 @@ int ff_vk_exec_add_dep_bool_sem(FFVulkanContext *s, FFVkExecContext *e,
>           }
>   
>           return 0;
>       }
>   
> -    buf_size = sizeof(int) + sizeof(VkSemaphore)*nb;
> +    buf_size = sizeof(*ts) + sizeof(VkSemaphore)*nb;
>       ts = av_mallocz(buf_size);
>       if (!ts) {
>           err = AVERROR(ENOMEM);
>           goto fail;
>       }
> 
> base-commit: f456522e32ec2577745d4669dc333be298d85907

Thanks, pushed, along with another similar fix.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xA2FEA5F03F034464.asc
Type: application/pgp-keys
Size: 624 bytes
Desc: OpenPGP public key
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20241009/b3389682/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 236 bytes
Desc: OpenPGP digital signature
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20241009/b3389682/attachment.sig>