Builder ffmpeg64-solaris10-i386 Build #13418

Results:

Failed shell_2 shell_3 shell_4 shell_5

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpeg64-solaris10-i386' triggered this build

Steps and Logfiles:

1. git update ( 4 secs )
   1. stdio
2. shell 'gsed -i ...' ( 0 secs )
   1. stdio
3. shell_1 'gsed -i ...' ( 0 secs )
   1. stdio
4. shell_2 'gsed -i ...' failed ( 0 secs )
   1. stdio
5. shell_3 './configure --samples="../../../ffmpeg/fate-suite" ...' failed ( 7 secs )
   1. stdio
   2. config.log
6. shell_4 'gmake fate-rsync' failed ( 0 secs )
   1. stdio
7. shell_5 '../../../ffmpeg/fate.sh ../../../ffmpeg/fate_config_64.sh' failed ( 0 secs )
   1. stdio
   2. configure.log
   3. compile.log
   4. test.log

Build Properties:

Forced Build Properties:

Responsible Users:

1. Nicholas Carlini

   nicholasohnoyoudont@carlini.com

Timing:

All Changes:

:

1. Change #261045

   Category	ffmpeg
   Changed by	Nicholas Carlini <nicholasohnoyoudont@carlini.com>
   Changed at	Sat 14 Mar 2026 17:52:58
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	39e1969303a0b9ec5fb5f5eb643bf7a5b69c0a89

   Comments

   avcodec/h264_slice: reject slice_num >= 0xFFFF
   An H.264 picture with 65536 slices makes slice_num collide with the
   slice_table sentinel. slice_table is uint16_t, initialized via
   memset(..., -1, ...) so spare entries (one per row, mb_stride =
   mb_width + 1) stay 0xFFFF. slice_num is an uncapped ++h->current_slice.
   At slice 65535 the collision makes slice_table[spare] == slice_num
   pass, defeating the deblock_topleft check in xchg_mb_border and the
   top_type zeroing in fill_decode_caches.
   
   With both guards bypassed at mb_x = 0, top_borders[top_idx][-1]
   underflows 96 bytes and XCHG writes at -88 below the allocation
   (plus -72 and -56 for chroma in the non-444 path).
   
   Fixes: heap-buffer-overflow
   
   Found-by: Nicholas Carlini <nicholas@carlini.com>
   Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

   Changed files

   • libavcodec/h264_slice.c