This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new e5c1ca60d8 avcodec/cbs_h266_syntax_template: bound slice width/height
by remaining tiles
e5c1ca60d8 is described below
commit e5c1ca60d8e44fd388f7cc63aa2d4283d6c931df
Author: Michael Niedermayer <[email protected]>
AuthorDate: Thu Feb 19 00:30:54 2026 +0100
Commit: Michael Niedermayer <[email protected]>
CommitDate: Fri Mar 6 04:06:01 2026 +0100
avcodec/cbs_h266_syntax_template: bound slice width/height by remaining
tiles
Fixes: out of array access
Fixes: crash_vvc_heap_oob_read.bin
Found-by: akshay jain <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/cbs_h266_syntax_template.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/cbs_h266_syntax_template.c
b/libavcodec/cbs_h266_syntax_template.c
index d33240e7df..0ff7459f5c 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -1973,14 +1973,14 @@ static int FUNC(pps) (CodedBitstreamContext *ctx,
RWContext *rw,
tile_y = tile_idx / current->num_tile_columns;
if (tile_x != current->num_tile_columns - 1) {
ues(pps_slice_width_in_tiles_minus1[i],
- 0, current->num_tile_columns - 1, 1, i);
+ 0, current->num_tile_columns - 1 - tile_x, 1, i);
} else {
infer(pps_slice_width_in_tiles_minus1[i], 0);
}
if (tile_y != current->num_tile_rows - 1 &&
(current->pps_tile_idx_delta_present_flag || tile_x == 0))
{
ues(pps_slice_height_in_tiles_minus1[i],
- 0, current->num_tile_rows - 1, 1, i);
+ 0, current->num_tile_rows - 1 - tile_y, 1, i);
} else {
if (tile_y == current->num_tile_rows - 1)
infer(pps_slice_height_in_tiles_minus1[i], 0);
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
