From 2c71a28bf0731f5fdcf9f2366ab98c31270294e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Neves?= Date: Wed, 8 Apr 2026 13:55:37 -0700 Subject: [PATCH] avcodec/hdrdec: fix pixel count decrement in RLE decompress loop MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The w variable counts pixels, not bytes. The non-RLE path correctly uses w-- (one pixel = 4 bytes), but the RLE path uses w -= 4, causing the loop to terminate after roughly 1/4 of the expected pixels. The w -= 4 was introduced in 14e99cb472 which moved the decrement inside the loop to fix an OOB write (clusterfuzz-5423041009549312). The move was correct, but the decrement value should have been 1 to match the non-RLE path. Signed-off-by: João Neves --- libavcodec/hdrdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/hdrdec.c b/libavcodec/hdrdec.c index cffa7570db..1a6935ff75 100644 --- a/libavcodec/hdrdec.c +++ b/libavcodec/hdrdec.c @@ -72,7 +72,7 @@ static int decompress(uint8_t *scanline, int w, GetByteContext *gb, const uint8_ for (int i = run << rshift; i > 0 && w > 0 && scanline >= start + 4; i--) { memcpy(scanline, scanline - 4, 4); scanline += 4; - w -= 4; + w--; } rshift += 8; if (rshift > 16)