This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 72a38c12e5 lavc/vvc: Prevent OOB write to slice_top_left_ctu_x in PPS
CBS
72a38c12e5 is described below
commit 72a38c12e5b84ccb30fba88c39ef2a086013af5b
Author: Frank Plowman <[email protected]>
AuthorDate: Mon Dec 29 22:14:53 2025 +0000
Commit: Timo Rothenpieler <[email protected]>
CommitDate: Tue Dec 30 13:39:40 2025 +0000
lavc/vvc: Prevent OOB write to slice_top_left_ctu_x in PPS CBS
Prior to the fix, in the case of a tile containing multiple slices
(pps_num_exp_slices_in_tile != 0) the number of slices was temporarily
allowed to exceed pps_num_slices_in_pic_minus1+1 and therefore
VVC_MAX_SLICES. The number of slices was later verified, but while the
current slice index was higher than expected it was used to write to a
array of size VVC_MAX_SLICES, leading to an OOB write.
To rectify this, the patch adds some checks at an earlier stage, to
ensure that the slice index i + j at no point exceeds
pps_num_slices_in_pic_minus1.
Fixes #YWH-PGM40646-30
---
libavcodec/cbs_h266_syntax_template.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/libavcodec/cbs_h266_syntax_template.c
b/libavcodec/cbs_h266_syntax_template.c
index d9a65a9c19..4f6ae76e27 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -2011,6 +2011,12 @@ static int FUNC(pps) (CodedBitstreamContext *ctx,
RWContext *rw,
slice_top_left_ctu_y[i] = ctu_y;
} else {
uint16_t slice_height_in_ctus;
+ int num_uniform_slices;
+
+ if (i + current->pps_num_exp_slices_in_tile[i] >
+ current->pps_num_slices_in_pic_minus1 + 1)
+ return AVERROR_INVALIDDATA;
+
for (j = 0; j < current->pps_num_exp_slices_in_tile[i];
j++) {
ues(pps_exp_slice_height_in_ctus_minus1[i][j], 0,
@@ -2031,6 +2037,13 @@ static int FUNC(pps) (CodedBitstreamContext *ctx,
RWContext *rw,
uniform_slice_height = 1 +
(j == 0 ? current->row_height_val[tile_y] - 1:
current->pps_exp_slice_height_in_ctus_minus1[i][j-1]);
+
+ num_uniform_slices = (remaining_height_in_ctbs_y +
uniform_slice_height - 1)
+ / uniform_slice_height;
+ if (i + current->pps_num_exp_slices_in_tile[i] +
num_uniform_slices >
+ current->pps_num_slices_in_pic_minus1 + 1)
+ return AVERROR_INVALIDDATA;
+
while (remaining_height_in_ctbs_y >
uniform_slice_height) {
current->slice_height_in_ctus[i + j] =
uniform_slice_height;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
