sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avcodec/cbs_h265: bound the number of decoding units by the picture size and the slice segment limit

Browse Source 
Fixes: out of array write
Fixes: feHKdS1bdTcu
Found-by: Zheng Yu @ Depthfirst
This commit is contained in:
Michael Niedermayer
2026-09-26 01:08:09 +02:00
committed by James Almer
parent 1586fd2dc2
commit 8864fd0aec
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/cbs_h265_syntax_template.c
View File

@@ -1986,8 +1986,14 @@ SEI_FUNC(sei_pic_timing, (CodedBitstreamContext *ctx, RWContext *rw,
if (hrd->sub_pic_hrd_params_present_flag &&
hrd->sub_pic_cpb_params_in_pic_timing_sei_flag) {
// Each decoding unit must contain at least one slice segment.
ue(num_decoding_units_minus1, 0, HEVC_MAX_SLICE_SEGMENTS);
unsigned int pic_width_in_ctbs_y, pic_height_in_ctbs_y;
cbs_h265_pic_size_in_ctbs(sps, &pic_width_in_ctbs_y, &pic_height_in_ctbs_y);
// D.3.3 bounds this by PicSizeInCtbsY - 1. A decoding unit holds at
// least one VCL NAL unit (3.47) and no level allows a picture more
// than HEVC_MAX_SLICE_SEGMENTS slice segments (A.4.2), which is also
// the size of the arrays indexed by it.
ue(num_decoding_units_minus1, 0,
FFMIN(pic_width_in_ctbs_y * pic_height_in_ctbs_y, HEVC_MAX_SLICE_SEGMENTS) - 1);
flag(du_common_cpb_removal_delay_flag);
length = hrd->du_cpb_removal_delay_increment_length_minus1 + 1;