sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

lavc/vvc: Prevent OOB write in sh_entry_points

Browse Source 
Fixes: out of array access
Fixes: Af5rtPnOunVT
Found-by: Umar Pathan (Umar0x)
Signed-off-by: Umar Pathan <hello@umar.ac>
(cherry picked from commit a809a784ec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Umar Pathan
2026-08-26 00:00:00 +00:00
committed by Michael Niedermayer
parent 2f52e998c4
commit 54beaa2687
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/vvc/ps.c
View File

@@ -1439,7 +1439,7 @@ static void sh_partition_constraints(VVCSH *sh, const H266RawSPS *sps, const H26
sh->min_qt_size[CHROMA] = 1 << min_qt_log2_size_y[CHROMA];
}
static void sh_entry_points(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps)
static int sh_entry_points(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps)
{
if (sps->sps_entry_point_offsets_present_flag) {
for (int i = 1, j = 0; i < sh->num_ctus_in_curr_slice; i++) {
@@ -1450,10 +1450,14 @@ static void sh_entry_points(VVCSH *sh, const H266RawSPS *sps, const VVCPPS *pps)
if (pps->ctb_to_row_bd[ctb_addr_y] != pps->ctb_to_row_bd[pre_ctb_addr_y] ||
pps->ctb_to_col_bd[ctb_addr_x] != pps->ctb_to_col_bd[pre_ctb_addr_x] ||
(ctb_addr_y != pre_ctb_addr_y && sps->sps_entropy_coding_sync_enabled_flag)) {
if (j >= VVC_MAX_ENTRY_POINTS)
return AVERROR_INVALIDDATA;
sh->entry_point_start_ctu[j++] = i;
}
}
}
return 0;
}
static int sh_derive(VVCSH *sh, const VVCFrameParamSets *fps)
@@ -1473,7 +1477,9 @@ static int sh_derive(VVCSH *sh, const VVCFrameParamSets *fps)
sh_qp_y(sh, pps, ph);
sh_deblock_offsets(sh);
sh_partition_constraints(sh, sps, ph);
sh_entry_points(sh, sps, fps->pps);
ret = sh_entry_points(sh, sps, fps->pps);
if (ret < 0)
return ret;
return 0;
}