From fb862976df08b3b132491abca9956f2fe9f96bc1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= Date: Wed, 6 Aug 2025 18:26:42 +0200 Subject: [PATCH] avcodec/cbs_h266_syntax_template: fix out of bounds access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit current->num_tile_columns is not updated in the loop, so the existing check was not working. Check current index instead and break. This also simplifies duplicated log. Fixes: 435225531/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_METADATA_fuzzer-6639684232216576 Found-by: OSS-Fuzz Signed-off-by: Kacper Michajłow --- libavcodec/cbs_h266_syntax_template.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c index e2cc461bff..8b337c75d0 100644 --- a/libavcodec/cbs_h266_syntax_template.c +++ b/libavcodec/cbs_h266_syntax_template.c @@ -1897,10 +1897,10 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, } unified_size = current->pps_tile_column_width_minus1[i - 1] + 1; while (remaining_size > 0) { - if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) { + if (i == VVC_MAX_TILE_COLUMNS) { av_log(ctx->log_ctx, AV_LOG_ERROR, - "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n", - current->num_tile_columns, VVC_MAX_TILE_COLUMNS); + "Exceeded maximum tile columns (%d) (remaining size: %u)\n", + VVC_MAX_TILE_COLUMNS, remaining_size); return AVERROR_INVALIDDATA; } unified_size = FFMIN(remaining_size, unified_size); @@ -1909,12 +1909,6 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, i++; } current->num_tile_columns = i; - if (current->num_tile_columns > VVC_MAX_TILE_COLUMNS) { - av_log(ctx->log_ctx, AV_LOG_ERROR, - "NumTileColumns(%d) > than VVC_MAX_TILE_COLUMNS(%d)\n", - current->num_tile_columns, VVC_MAX_TILE_COLUMNS); - return AVERROR_INVALIDDATA; - } remaining_size = pic_height_in_ctbs_y; for (i = 0; i <= current->pps_num_exp_tile_rows_minus1; i++) { @@ -1929,18 +1923,18 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw, unified_size = current->pps_tile_row_height_minus1[i - 1] + 1; while (remaining_size > 0) { + if (i == VVC_MAX_TILE_ROWS) { + av_log(ctx->log_ctx, AV_LOG_ERROR, + "Exceeded maximum tile rows (%d) (remaining size: %u)\n", + VVC_MAX_TILE_ROWS, remaining_size); + return AVERROR_INVALIDDATA; + } unified_size = FFMIN(remaining_size, unified_size); current->row_height_val[i] = unified_size; remaining_size -= unified_size; i++; } current->num_tile_rows=i; - if (current->num_tile_rows > VVC_MAX_TILE_ROWS) { - av_log(ctx->log_ctx, AV_LOG_ERROR, - "NumTileRows(%d) > than VVC_MAX_TILE_ROWS(%d)\n", - current->num_tile_rows, VVC_MAX_TILE_ROWS); - return AVERROR_INVALIDDATA; - } current->num_tiles_in_pic = current->num_tile_columns * current->num_tile_rows;