History

avcodec/cbs_h266_syntax_template: fix out of bounds access

current->num_tile_columns is not updated in the loop, so the existing check was not working. Check current index instead and break. This also simplifies duplicated log.

Kacper Michajłow committed 1 year ago

Commit fb862971 parent 75f30b41 file · +9 −15Browse files

Unified · Split

libavcodec/cbs_h266_syntax_template.c+9−15
@@ -1897,10 +1897,10 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, · 1896 unmodified lines
1897 }1897 }
1898 unified_size = current->pps_tile_column_width_minus1[i - 1] + 1;1898 unified_size = current->pps_tile_column_width_minus1[i - 1] + 1;
1899 while (remaining_size > 0) {1899 while (remaining_size > 0) {
1900 if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {1900 if (i == VVC_MAX_TILE_COLUMNS) {
1901 av_log(ctx->log_ctx, AV_LOG_ERROR,1901 av_log(ctx->log_ctx, AV_LOG_ERROR,
1902 "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",1902 "Exceeded maximum tile columns (%d) (remaining size: %u)\n",
1903 current->num_tile_columns, VVC_MAX_TILE_COLUMNS);1903 VVC_MAX_TILE_COLUMNS, remaining_size);
1904 return AVERROR_INVALIDDATA;1904 return AVERROR_INVALIDDATA;
1905 }1905 }
1906 unified_size = FFMIN(remaining_size, unified_size);1906 unified_size = FFMIN(remaining_size, unified_size);
@@ -1909,12 +1909,6 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, · 2 unmodified lines
1909 i++;1909 i++;
1910 }1910 }
1911 current->num_tile_columns = i;1911 current->num_tile_columns = i;
1912 if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {
1913 av_log(ctx->log_ctx, AV_LOG_ERROR,
1914 "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",
1915 current->num_tile_columns, VVC_MAX_TILE_COLUMNS);
1916 return AVERROR_INVALIDDATA;
1917 }
1918 1912
1919 remaining_size = pic_height_in_ctbs_y;1913 remaining_size = pic_height_in_ctbs_y;
1920 for (i = 0; i <= current->pps_num_exp_tile_rows_minus1; i++) {1914 for (i = 0; i <= current->pps_num_exp_tile_rows_minus1; i++) {
@@ -1929,18 +1923,18 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, · 8 unmodified lines
1929 unified_size = current->pps_tile_row_height_minus1[i - 1] + 1;1923 unified_size = current->pps_tile_row_height_minus1[i - 1] + 1;
1930 1924
1931 while (remaining_size > 0) {1925 while (remaining_size > 0) {
1926 if (i == VVC_MAX_TILE_ROWS) {
1927 av_log(ctx->log_ctx, AV_LOG_ERROR,
1928 "Exceeded maximum tile rows (%d) (remaining size: %u)\n",
1929 VVC_MAX_TILE_ROWS, remaining_size);
1930 return AVERROR_INVALIDDATA;
1931 }
1932 unified_size = FFMIN(remaining_size, unified_size);1932 unified_size = FFMIN(remaining_size, unified_size);
1933 current->row_height_val[i] = unified_size;1933 current->row_height_val[i] = unified_size;
1934 remaining_size -= unified_size;1934 remaining_size -= unified_size;
1935 i++;1935 i++;
1936 }1936 }
1937 current->num_tile_rows=i;1937 current->num_tile_rows=i;
1938 if (current->num_tile_rows > VVC_MAX_TILE_ROWS) {
1939 av_log(ctx->log_ctx, AV_LOG_ERROR,
1940 "NumTileRows(%d) > than VVC_MAX_TILE_ROWS(%d)\n",
1941 current->num_tile_rows, VVC_MAX_TILE_ROWS);
1942 return AVERROR_INVALIDDATA;
1943 }
1944 1938
1945 current->num_tiles_in_pic = current->num_tile_columns *1939 current->num_tiles_in_pic = current->num_tile_columns *
1946 current->num_tile_rows;1940 current->num_tile_rows;

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t