From 8864fd0aecf21fe9e3cfcd83a8ef33cb7e885fd4 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 26 Sep 2026 01:08:09 +0200 Subject: [PATCH] avcodec/cbs_h265: bound the number of decoding units by the picture size and the slice segment limit Fixes: out of array write Fixes: feHKdS1bdTcu Found-by: Zheng Yu @ Depthfirst --- libavcodec/cbs_h265_syntax_template.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c index 0550ed074c..1e03bdf63e 100644 --- a/libavcodec/cbs_h265_syntax_template.c +++ b/libavcodec/cbs_h265_syntax_template.c @@ -1986,8 +1986,14 @@ SEI_FUNC(sei_pic_timing, (CodedBitstreamContext *ctx, RWContext *rw, if (hrd->sub_pic_hrd_params_present_flag && hrd->sub_pic_cpb_params_in_pic_timing_sei_flag) { - // Each decoding unit must contain at least one slice segment. - ue(num_decoding_units_minus1, 0, HEVC_MAX_SLICE_SEGMENTS); + unsigned int pic_width_in_ctbs_y, pic_height_in_ctbs_y; + cbs_h265_pic_size_in_ctbs(sps, &pic_width_in_ctbs_y, &pic_height_in_ctbs_y); + // D.3.3 bounds this by PicSizeInCtbsY - 1. A decoding unit holds at + // least one VCL NAL unit (3.47) and no level allows a picture more + // than HEVC_MAX_SLICE_SEGMENTS slice segments (A.4.2), which is also + // the size of the arrays indexed by it. + ue(num_decoding_units_minus1, 0, + FFMIN(pic_width_in_ctbs_y * pic_height_in_ctbs_y, HEVC_MAX_SLICE_SEGMENTS) - 1); flag(du_common_cpb_removal_delay_flag); length = hrd->du_cpb_removal_delay_increment_length_minus1 + 1;