breeze/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-02-04 14:30:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/cbs_h266_syntax_template: fix out of bounds access

Browse Source 
current->num_tile_columns is not updated in the loop, so the existing
check was not working. Check current index instead and break. This also
simplifies duplicated log.

Fixes: 435225531/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-6639684232216576
Found-by: OSS-Fuzz
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit fb862976df)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Kacper Michajłow
2025-08-06 18:26:42 +02:00
committed by Michael Niedermayer
parent cb491e8cb3
commit e19066e0aa
1 changed files with 9 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
libavcodec/cbs_h266_syntax_template.c
View File

@@ -1899,10 +1899,10 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
}
unified_size = current->pps_tile_column_width_minus1[i - 1] + 1;
while (remaining_size > 0) {
if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {
if (i == VVC_MAX_TILE_COLUMNS) {
av_log(ctx->log_ctx, AV_LOG_ERROR,
"NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",
current->num_tile_columns, VVC_MAX_TILE_COLUMNS);
"Exceeded maximum tile columns (%d) (remaining size: %u)\n",
VVC_MAX_TILE_COLUMNS, remaining_size);
return AVERROR_INVALIDDATA;
}
unified_size = FFMIN(remaining_size, unified_size);
@@ -1911,12 +1911,6 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
i++;
}
current->num_tile_columns = i;
if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) {
av_log(ctx->log_ctx, AV_LOG_ERROR,
"NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n",
current->num_tile_columns, VVC_MAX_TILE_COLUMNS);
return AVERROR_INVALIDDATA;
}
remaining_size = pic_height_in_ctbs_y;
for (i = 0; i <= current->pps_num_exp_tile_rows_minus1; i++) {
@@ -1931,18 +1925,18 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
unified_size = current->pps_tile_row_height_minus1[i - 1] + 1;
while (remaining_size > 0) {
if (i == VVC_MAX_TILE_ROWS) {
av_log(ctx->log_ctx, AV_LOG_ERROR,
"Exceeded maximum tile rows (%d) (remaining size: %u)\n",
VVC_MAX_TILE_ROWS, remaining_size);
return AVERROR_INVALIDDATA;
}
unified_size = FFMIN(remaining_size, unified_size);
current->row_height_val[i] = unified_size;
remaining_size -= unified_size;
i++;
}
current->num_tile_rows=i;
if (current->num_tile_rows > VVC_MAX_TILE_ROWS) {
av_log(ctx->log_ctx, AV_LOG_ERROR,
"NumTileRows(%d) > than VVC_MAX_TILE_ROWS(%d)\n",
current->num_tile_rows, VVC_MAX_TILE_ROWS);
return AVERROR_INVALIDDATA;
}
current->num_tiles_in_pic = current->num_tile_columns *
current->num_tile_rows;