sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avcodec/cbs_h266: allocate the VPS profile_tier_level array on demand

Browse Source 
Allocate the array for the number of PTLs the VPS signals, like the
extension data. This shrinks H266RawVPS to 41 KB.

Out of memory Replicated through API

Found during triage/review of OSS-Fuzz issue 529105369

Fixes: out of memory
Fixes: b0PmzXuS2hhp/vps10k.bin / gen_vps.py
Fixes: b0PmzXuS2hhp

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-10-10 06:38:14 +02:00
committed by michaelni
parent 93739f4bbb
commit b8f74a99fb
3 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/cbs_h266.c
View File

@@ -143,7 +143,7 @@ static int FUNC_H266(name) args
AV_INPUT_BUFFER_PADDING_SIZE); \
if (!name ## _ref) \
return AVERROR(ENOMEM); \
name = name ## _ref->data; \
name = (void *)name ## _ref->data; \
} while (0)
#define FUNC(name) FUNC_H266(name)
@@ -760,7 +760,17 @@ static void cbs_h266_free_sei(AVRefStructOpaque unused, void *content)
static CodedBitstreamUnitTypeDescriptor cbs_h266_unit_types[] = {
CBS_UNIT_TYPE_INTERNAL_REF(VVC_DCI_NUT, H266RawDCI, extension_data.data),
CBS_UNIT_TYPE_INTERNAL_REF(VVC_OPI_NUT, H266RawOPI, extension_data.data),
CBS_UNIT_TYPE_INTERNAL_REF(VVC_VPS_NUT, H266RawVPS, extension_data.data),
{
.nb_unit_types = 1,
.unit_type.list[0] = VVC_VPS_NUT,
.content_type = CBS_CONTENT_TYPE_INTERNAL_REFS,
.content_size = sizeof(H266RawVPS),
.type.ref = {
.nb_offsets = 2,
.offsets = { offsetof(H266RawVPS, vps_profile_tier_level),
offsetof(H266RawVPS, extension_data.data) }
},
},
{
.nb_unit_types = 1,
.unit_type.list[0] = VVC_SPS_NUT,

3
libavcodec/cbs_h266.h
View File

@@ -280,7 +280,8 @@ typedef struct H266RawVPS {
uint8_t vps_num_ptls_minus1;
uint8_t vps_pt_present_flag[VVC_MAX_PTLS];
uint8_t vps_ptl_max_tid[VVC_MAX_PTLS];
H266RawProfileTierLevel vps_profile_tier_level[VVC_MAX_PTLS];
H266RawProfileTierLevel *vps_profile_tier_level;
AVBufferRef *vps_profile_tier_level_ref;
uint8_t vps_ols_ptl_idx[VVC_MAX_TOTAL_NUM_OLSS];
uint16_t vps_num_dpb_params_minus1;

3
libavcodec/cbs_h266_syntax_template.c
View File

@@ -930,6 +930,9 @@ static int FUNC(vps) (CodedBitstreamContext *ctx, RWContext *rw,
return AVERROR_INVALIDDATA;
}
allocate(current->vps_profile_tier_level,
(current->vps_num_ptls_minus1 + 1) *
sizeof(*current->vps_profile_tier_level));
for (i = 0; i <= current->vps_num_ptls_minus1; i++) {
CHECK(FUNC(profile_tier_level) (ctx, rw,
current->vps_profile_tier_level + i,