History

avcodec/cbs_h266_syntax_template: fix out of bounds access

current->num_tile_columns is not updated in the loop, so the existing check was not working. Check current index instead and break. This also simplifies duplicated log.

Kacper Michajłow committed 1 year ago

Commit fb862971 parent 75f30b41 file · +9 −15Browse files

Unified · Split

libavcodec/cbs_h266_syntax_template.c+9−15
@@ -1897,10 +1897,10 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, · 1896 unmodified lines
18971897 }
18981898 unified_size = current->pps_tile_column_width_minus1[i - 1] + 1;
18991899 while (remaining_size > 0) {
1900− if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {
1900+ if (i == VVC_MAX_TILE_COLUMNS) {
19011901 av_log(ctx->log_ctx, AV_LOG_ERROR,
1902− "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",
1903− current->num_tile_columns, VVC_MAX_TILE_COLUMNS);
1902+ "Exceeded maximum tile columns (%d) (remaining size: %u)\n",
1903+ VVC_MAX_TILE_COLUMNS, remaining_size);
19041904 return AVERROR_INVALIDDATA;
19051905 }
19061906 unified_size = FFMIN(remaining_size, unified_size);
@@ -1909,12 +1909,6 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, · 2 unmodified lines
19091909 i++;
19101910 }
19111911 current->num_tile_columns = i;
1912− if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {
1913− av_log(ctx->log_ctx, AV_LOG_ERROR,
1914− "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",
1915− current->num_tile_columns, VVC_MAX_TILE_COLUMNS);
1916− return AVERROR_INVALIDDATA;
1917− }
19181912
19191913 remaining_size = pic_height_in_ctbs_y;
19201914 for (i = 0; i <= current->pps_num_exp_tile_rows_minus1; i++) {
@@ -1929,18 +1923,18 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, · 8 unmodified lines
19291923 unified_size = current->pps_tile_row_height_minus1[i - 1] + 1;
19301924
19311925 while (remaining_size > 0) {
1926+ if (i == VVC_MAX_TILE_ROWS) {
1927+ av_log(ctx->log_ctx, AV_LOG_ERROR,
1928+ "Exceeded maximum tile rows (%d) (remaining size: %u)\n",
1929+ VVC_MAX_TILE_ROWS, remaining_size);
1930+ return AVERROR_INVALIDDATA;
1931+ }
19321932 unified_size = FFMIN(remaining_size, unified_size);
19331933 current->row_height_val[i] = unified_size;
19341934 remaining_size -= unified_size;
19351935 i++;
19361936 }
19371937 current->num_tile_rows=i;
1938− if (current->num_tile_rows > VVC_MAX_TILE_ROWS) {
1939− av_log(ctx->log_ctx, AV_LOG_ERROR,
1940− "NumTileRows(%d) > than VVC_MAX_TILE_ROWS(%d)\n",
1941− current->num_tile_rows, VVC_MAX_TILE_ROWS);
1942− return AVERROR_INVALIDDATA;
1943− }
19441938
19451939 current->num_tiles_in_pic = current->num_tile_columns *
19461940 current->num_tile_rows;

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t